DroidLock
| DroidLock | |
|---|---|
| Malware details | |
| Type | Ransomware-style malware |
| Authors | Unknown threat actors |
DroidLock is a strain of Android Ransomware targeting Android devices that was publicly identified in 10 December, 2025.[1][2] It is distinguished by its ability to take complete control of infected devices, display ransom‑style overlays, lock access, and execute commands from remote attackers. Security research into DroidLock has been conducted by mobile security firms including Zimperium and reported by cybersecurity publications.[3][4][5]
Overview
DroidLock is distributed through malicious or fraudulent websites that trick users into downloading a seemingly legitimate application. Once the user installs this dropper app and grants required permissions, DroidLock obtains elevated access through Device Administrator and Accessibility service permissions.[6] These permissions give the malware extensive control over the device's functions and data.[7]
Although described as “ransomware‑style,” DroidLock does not encrypt user files as traditional ransomware does. Instead it locks the user out of the device, threatens data deletion, and displays coercive messages demanding payment within a set timeframe.[8][9]
Detection and mitigation
Android's built‑in security feature Google Play Protect may identify and block known DroidLock samples on devices with up‑to‑date protections enabled. Security experts recommend that users only install applications from trusted official sources such as the Google Play store and avoid sideloading apps from unknown or unverified sources.[10]
Additional mitigation strategies include rejecting unnecessary or high‑risk permission requests, especially those involving Accessibility Services, and keeping device software and security definitions updated.
Reception
Zimperium's zLabs researchers describe DroidLock as a sophisticated Android threat capable of full device takeover. Their analysis highlights its use of multi‑stage droppers, command‑and‑control communication, and extensive abuse of system permissions. zLabs reports that the malware can change lock credentials, display fake system update screens, capture sensitive information, and remotely control infected devices using Virtual Network Computing.[11][12] They classify DroidLock as part of a growing trend toward non‑encryption‑based mobile ransomware.
According to Malwarebytes, DroidLock represents a new class of Android malware that locks users out of their devices and demands payment through full‑screen ransom messages.[13] The malware spreads through malicious websites and fake applications that request powerful permissions such as Device Administrator and Accessibility service. Malwarebytes notes that although DroidLock does not encrypt files like traditional ransomware, its ability to block access and threaten data deletion creates a comparable extortion effect for victims.[14]
See also
References
- ^ "New Android ransomware DroidLock takes full control of device". Inshorts - Stay Informed. Retrieved 2025-12-13.
- ^ "New 'DroidLock' malware demands a ransom, locks user out of device". therecord.media. Retrieved 2025-12-13.
- ^ "Total Takeover: DroidLock Hijacks Your Device". zimperium.com. Retrieved 2025-12-13.
- ^ www.sourcesecurity.com https://www.sourcesecurity.com/news/zimperium-uncovers-droidlock-android-ransomware-campaign-co-1641807473-ga.1765453190.html. Retrieved 2025-12-13.
{{cite web}}: Missing or empty|title=(help) - ^ "New DroidLock threat gives attackers near-total control of Android phones". SiliconANGLE. 2025-12-10. Retrieved 2025-12-13.
- ^ "New 'DroidLock' Android Malware Locks Users Out, Spies via Front Camera". Retrieved 2025-12-13.
- ^ Lee, Tyler (2025-12-12). "DroidLock Ransomware Aims to Take Control of Your Android Device". Android Headlines. Retrieved 2025-12-13.
- ^ Kathir, Mayura (2025-12-11). "New DroidLock Malware Locks Android Devices and Demands Ransom Payment". GBHackers Security | #1 Globally Trusted Cyber Security News Platform. Retrieved 2025-12-13.
- ^ "New Android Malware Locks Device Screens And Demands Ransom". 2025-12-12. Retrieved 2025-12-13.
- ^ updated, Amber Bouman last (2025-12-11). "How to avoid the nightmare Android malware that can hold your device for ransom or erase it". Tom's Guide. Retrieved 2025-12-13.
{{cite web}}:|last=has generic name (help) - ^ "Android Phones Hit By New DroidLock Malware That Locks Users Out And Demands Ransom". Techlusive. Retrieved 2025-12-13.
- ^ "DroidLock ransomware locks Android phones and demands ransom". Irish Star. 2025-12-11. Retrieved 2025-12-13.
- ^ Arntz, Pieter (2025-12-11). "DroidLock malware locks you out of your Android device and demands ransom". Malwarebytes. Retrieved 2025-12-13.
- ^ Carroll, Dave Snelling, Amrita (2025-12-11). "Android warning as 'ransomware' locks phones and threatens to 'delete' files". Daily Express US. Retrieved 2025-12-13.
{{cite web}}: CS1 maint: multiple names: authors list (link)