Trojan-Banker.AndroidOS.Svpeng

Malware in this family obtains administrator rights on an infected device in a hidden way. The malware then shows a fake web page that is designed to fool the user. Using administrator rights, the malware intercepts requests when the user tries to access paid online services and online banks, such as Sberbank, Privat24, and Play Market. Trojan-Banker.AndroidOS.Svpeng intercepts a request and asks the user to enter his or her banking information.

This malware uses special methods to resist removal. For example, the program can:

• Prevent the user from opening the settings window (by closing the window as soon as the user opens it).
• Deceive the user by stating that device settings will be lost (factory reset).
• Display a message that the user is entering an incorrect password, even though the password is the correct one.

Top 10 countries with most attacked users (% of total attacks)

* Percentage of all unique Kaspersky users attacked by this malware