Malware

CovidLock

CovidLock is an Android ransomware family that emerged in early 2020 and exploited public fear surrounding the COVID-19 pandemic by masquerading as a coronavirus tracking or outbreak-map application. It was distributed outside the official Google Play ecosystem as a sideloaded APK delivered from attacker-controlled websites and relied on social engineering to persuade users to install it and grant elevated permissions.

After installation, CovidLock requested device administrator access and, in some reported cases, Accessibility-related permissions under the pretense of enabling pandemic alerts or nearby-infection notifications. Once activated, it locked the victim’s device, changed the device password, and displayed a ransom note demanding payment in cryptocurrency within a short deadline while threatening data loss or public exposure of personal information. Reporting consistently associates the malware with device-locking extortion behavior against Android users.

Public reporting on whether CovidLock performed real file encryption is inconsistent. Some accounts described it as encrypting files on the device, while reverse-engineering of a widely analyzed sample found that it primarily functioned as locker ransomware and did not actually encrypt files or exfiltrate data. High-confidence characterization therefore supports Android locker-style ransomware behavior centered on denying access to the device through abuse of administrative controls rather than confirmed large-scale data theft.

CovidLock is notable as an early example of pandemic-themed mobile ransomware and illustrates how threat actors rapidly weaponized crisis-related lures to obtain initial access on consumer devices. Its targeting was opportunistic rather than sector-specific, focusing on Android users seeking COVID-19 information or tracking tools.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence2

Multiple malicious websites were constructed to deliver the Grandoreio banking trojan. The sites utilized a ‘video player’ download-style lure to entice victims into executing the Grandoreio payloads.

Execution

3 techniques

T1204User ExecutionEvidence2

Once opened, the app asks for access to your lock screen... The app also asks for permission of an Android phone's accessibility settings... If an unsuspecting user grants these permissions to the app, ransomware dubbed "CovidLock" is enabled.

T1204.001Malicious LinkEvidence1

Click on a link or download an app that may lead to a phishing website, or the downloading of malware, including ransomware.

T1204.002Malicious FileEvidence3

The emails contain a RAR’d or Gzip’d attachments that install the Agent Tesla RAT upon execution. | Victims were enticed into downloading and installing a trojanized version of the “Folding@home” client software.

Persistence

2 techniques

T1546.008Accessibility FeaturesEvidence1

After the initial phase, the app requests access to the Android's Accessibility feature... attackers often exploit this functionality to keep their malware persistent.

T1547Boot or Logon Autostart ExecutionEvidence1

The malware sets itself to load upon device startup and leads to a lock-screen style ransom request.

Privilege Escalation

3 techniques

T1546.008Accessibility FeaturesEvidence1

After the initial phase, the app requests access to the Android's Accessibility feature... attackers often exploit this functionality to keep their malware persistent.

T1547Boot or Logon Autostart ExecutionEvidence1

The malware sets itself to load upon device startup and leads to a lock-screen style ransom request.

T1548Abuse Elevation Control MechanismEvidence2

Next, the app asks for administrator privileges, which is a common red flag. The app tries to trick the victim, stating that admin rights will enable the app to notify the user when a coronavirus patient is nearby.

Stealth

2 techniques

T1036MasqueradingEvidence2

An app called "COVID19 Tracker" masking itself as a coronavirus outbreak map tracker is actually ransomware...

T1564Hide ArtifactsEvidence1

We also noticed that the app was hiding in the entire process. Figure 8 shows the hiding functionality, which enables the app to hide its icon and delete its activity from the Recent Apps list.

Impact

4 techniques

T1485Data DestructionEvidence1

"You have 48 hours to pay 100$ [sic] in bitcoin or everything will be erased... your contacts, your pictures and videos... the phone memory will be completely erased"

T1486Data Encrypted for ImpactEvidence5

When downloaded, this app encrypts the files on the user’s device... demanding a ransom of cryptocurrency to regain access.

T1490Inhibit System RecoveryEvidence1

As soon as the victim clicks "Scan Area For Coronavirus," the phone becomes locked, with a message on the locked screen... It asks for a $250 ransom in bitcoin.

T1531Account Access RemovalEvidence1

When downloaded, this app encrypts the files on the user’s device and changes the device’s password, demanding a ransom of cryptocurrency to regain access.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

sentinelone labsNews

Jul 15, 2026

Threat Intel | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic - SentinelLabs

Android ransomware delivered through fake COVID tracking apps; abuses permissions to gain device control and displays a lock-screen ransom note.

zscaler threat labzNews

Jan 1, 2026

Android Ransomware Walkthrough and How to Unlock | Zscaler

Android ransomware masquerading as a coronavirus tracking app. It requests battery optimization exclusion, accessibility access, and administrator privileges, then locks the device and displays a ransom demand for $250 in bitcoin. The sample analyzed did not actually encrypt files or exfiltrate data; instead, it used a hard-coded unlock key and hid its icon/process to impede removal.

springerNews

Oct 19, 2021

CovidLock Attack Simulation | Springer Nature Link

Android ransomware disguised as a COVID-19 tracking app that locks victims out of their device, encrypts files, changes the device password, and demands cryptocurrency payment for access restoration.

business insiderNews

Mar 16, 2020

Coronavirus App Actually Ransomware That Demands Money or Deletes Data - Business Insider

Android ransomware disguised as a coronavirus outbreak tracking app. It abuses lock screen and accessibility permissions to lock the device and demand a $100 Bitcoin payment within 48 hours, threatening data erasure and public leakage of social media accounts.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CovidLock