DroidLock malware can command Android machine lock

Got it. DroidLock malware can log Android machines to ransom victims.

Malware that captures machines or ransom files or Ransomware usually uses Encryption to lock files, coercing the owner to pay the ransom, but in this case it is different.

According to a report by the website Cyber Security News, a new malware campaign has been detected that focuses on a group of mobile phone users on the Android operating system in Spanish-speaking countries. This malware is called DroidLock. It has the ability to log malware-addicted and ransom machines. Although the malware does not have a clear type, it has similar behavior to Ransomware as mentioned above. In addition, the malware has the ability to gain control and steal a lot of data, allowing it to harm devices both at the user level and at the enterprise level.

The detection was by a research team from Zimperium, a mobile phone security expert. The research team revealed that the malware impersonates a famous application installer. After installing the victim, the application acts as a dropper. It requests access to the system at the Admin or Administrator level and access to the Disabled Assistance Mode or Accessibility Mode, and then contacts the C2 or Command and Control server through two channels, HTTP and WebSocket allows malware to send stolen data back to hackers and receive commands from the server in real time.

The research team also revealed the ability to steal data on a machine called similar to the malware type of bank account theft or Banking Trojan, such as

Using the Pattern handle used to unlock the machine or the banking application, this handle is directly connected to malware code. It activates as soon as the screen is unlocked or the banking app is used. It overlays the screen for unlocking in the form of an Overlay Attacks.

Data theft by stacking fake application screens with HTML-based screen code. The source does not say what the code is used, but it is expected to be via WebView). The code stacks imitation screens for bank applications to fool the theft of the access code. The malware compares the open application with the available list. If matched, the malware retrieves a fake screen similar to the app.

Not only that, the malware can also use screen logging tools to capture important information, such as passwords, OTP or One-Time Passwords, and Authentication Code, and also use the camera to secretly photograph the user.

And the most insidious ability that comes from the name is to lock the screen with the ransom screen. If the user does not pay within a specified time, he will delete all the data on the machine. What this malware is different from normal ransomware is that the malware does not need to encrypt (Encryption) to lock the file in any way, because the malware has access to the default feature from the factory or the Factory Reset that will result in the machine returning to its newly purchased condition and no data inside the machine immediately after the victim does not comply with the conditions.

# Welcome 2026 # Take care of yourself # Open budget # Includes IT matters # Trending