Loading story…
A new Android malware strain known as DroidLock has been identified by Zimperium researchers, targeting users—primarily in Spanish-speaking regions—through phishing websites and malicious apps that impersonate legitimate services. Once installed, DroidLock requests device administrator and accessibility permissions, enabling it to lock users out of their devices, change PINs or passwords, wipe data, and even erase the device entirely. The malware employs sophisticated overlay techniques to steal unlock patterns and app credentials, and can stream screen activity, access text messages, call logs, contacts, and audio recordings. Attackers can remotely control infected devices via VNC, turning smartphones into surveillance tools and hostile endpoints.
DroidLock communicates with its command-and-control server using both HTTP and WebSocket protocols, supporting at least 15 different commands for real-time manipulation. The infection process typically involves a dropper app that tricks users into installing the actual payload, bypassing Android security restrictions. Victims are presented with a full-screen ransom overlay, pressuring them to contact the attackers and pay a ransom within 24 hours or risk permanent data destruction. While DroidLock does not encrypt files like traditional ransomware, it achieves similar extortion by threatening to destroy or deny access to user data, making it a significant threat to both personal and corporate Android devices.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
After Zimperium shared its findings with Google, Play Protect was updated to detect and block DroidLock on protected Android devices. This marked the first documented defensive response from a platform vendor to the campaign.
Zimperium's zLabs identified a new Android malware campaign dubbed DroidLock targeting Spanish-speaking users through phishing websites and fake apps. The malware uses a dropper and abuses Accessibility and Device Admin permissions to lock devices, steal credentials, and threaten data destruction for ransom without encrypting files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourcemalwarebytes.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcezimperium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **DoubleLocker** Android malware combined two extortion techniques on a single device: it changed the victim’s screen PIN and encrypted files stored on the phone. The ransomware, detected as `Android/DoubleLocker.A`, was described as the first observed Android threat to abuse **accessibility services** to gain elevated privileges and then use them to activate **device administrator** rights, establish persistence, and lock users out while encrypting data with **AES**. Encrypted files were renamed with the `.cryeye` extension, and victims were told to pay **0.0130 BTC** within 24 hours. The malware was reportedly spread mainly through compromised websites posing as a fake **Adobe Flash Player** update. After installation, it set itself as the default Home application, blocked normal recovery steps, and assigned a random PIN that was not stored locally or sent to the operators, preventing straightforward recovery. ESET said the most reliable remediation was a **factory reset**, while some rooted devices with USB debugging already enabled might be unlocked through ADB; however, encrypted files could not be restored without the attackers’ decryption key.
Aug 14, 2026
Security researchers reported that the Android malware family **Xbot** evolved from a stealthy SMS-focused trojan into a broader banking and ransomware threat distributed through third-party app markets rather than Google Play. The malware masqueraded as trusted apps including **Google Play**, **Opera Browser**, **Android Market**, and **Minecraft**, then hid its launcher icon after installation to avoid detection. Early variants primarily targeted users in Russia and Eastern Europe, monitoring incoming SMS messages for selected keywords, exfiltrating messages to command-and-control infrastructure, sending premium-rate texts, downloading additional APKs, and persisting across reboots. Later analysis found Xbot embedded in 22 malicious apps and expanded to phishing **Google Play** payment details and login credentials for multiple banking apps, including major Australian banks and at least one Russian bank. The trojan used activity hijacking and **WebView** overlays to present fake login and card-entry screens, stole SMS messages and contacts, abused device administrator privileges, and accepted remote commands from its operators. Researchers also found ransomware functions that could lock the device, set a password, encrypt files on external storage with a simple XOR routine, and demand a **$100 PayPal My Cash Card** payment, while added obfuscation and dormant call-recording code indicated active ongoing development.
Aug 15, 2026
Researchers identified **Mantax Otax**, an Android hybrid spyware and ransomware family attributed to Indonesian threat actors and apparently targeting Indonesian users. Distributed through sideloaded APKs, it seeks device-administrator, sensitive runtime, and Accessibility permissions to gain extensive control, steal personal and communications data, capture screenshots and camera images, and—on Android 9 and earlier—encrypt user files with AES before demanding payment through an attacker-controlled chat interface. A newer **Mantax Otax v2** variant uses WebSockets to support persistent screen and application blocking, touch interception, overlay and dialog spam, jumpscare effects, and remote text-to-speech harassment. Its ability to capture GUI input and inject or interfere with user input aligns with mobile ATT&CK techniques `T1417.002` and `T1516`, increasing both the surveillance and coercive impact on compromised devices.
Sep 12, 2026