Loading story…
ESET reported that the DoubleLocker Android malware combined two extortion techniques on a single device: it changed the victim’s screen PIN and encrypted files stored on the phone. The ransomware, detected as Android/DoubleLocker.A, was described as the first observed Android threat to abuse accessibility services to gain elevated privileges and then use them to activate device administrator rights, establish persistence, and lock users out while encrypting data with AES. Encrypted files were renamed with the .cryeye extension, and victims were told to pay 0.0130 BTC within 24 hours.
The malware was reportedly spread mainly through compromised websites posing as a fake Adobe Flash Player update. After installation, it set itself as the default Home application, blocked normal recovery steps, and assigned a random PIN that was not stored locally or sent to the operators, preventing straightforward recovery. ESET said the most reliable remediation was a factory reset, while some rooted devices with USB debugging already enabled might be unlocked through ADB; however, encrypted files could not be restored without the attackers’ decryption key.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET researcher Lukáš Štefanko said the company had seen a test version of a similar ransom-banker concept in the wild as early as May 2017. This predates the later DoubleLocker discovery.
ESET reported a new Android ransomware family, detected as Android/DoubleLocker.A, that both changes a victim device’s PIN and encrypts files. The company described it as the first observed Android ransomware to misuse accessibility services and combine device locking with file encryption in this way.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Android malware strain known as **DroidLock** has been identified by Zimperium researchers, targeting users—primarily in Spanish-speaking regions—through phishing websites and malicious apps that impersonate legitimate services. Once installed, DroidLock requests device administrator and accessibility permissions, enabling it to lock users out of their devices, change PINs or passwords, wipe data, and even erase the device entirely. The malware employs sophisticated overlay techniques to steal unlock patterns and app credentials, and can stream screen activity, access text messages, call logs, contacts, and audio recordings. Attackers can remotely control infected devices via VNC, turning smartphones into surveillance tools and hostile endpoints. DroidLock communicates with its command-and-control server using both HTTP and WebSocket protocols, supporting at least 15 different commands for real-time manipulation. The infection process typically involves a dropper app that tricks users into installing the actual payload, bypassing Android security restrictions. Victims are presented with a full-screen ransom overlay, pressuring them to contact the attackers and pay a ransom within 24 hours or risk permanent data destruction. While DroidLock does not encrypt files like traditional ransomware, it achieves similar extortion by threatening to destroy or deny access to user data, making it a significant threat to both personal and corporate Android devices.
Jun 29, 2026
A new Android ransomware family tracked as **Android/Filecoder.C** was distributed through malicious posts on **Reddit** and the **XDA Developers** forum, then expanded its reach by sending SMS messages with malicious links to every contact on an infected device. After installation, the malware encrypted files on accessible storage, appended the `.seven` extension, and displayed a ransom note demanding payment in Bitcoin, typically between about **US$94 and US$188**. The malware used an unusual hybrid encryption routine that generated per-file **AES** keys and protected them with an embedded **RSA-1024** public key, leaving victims with no practical free decryption option. It also relied on hardcoded and dynamically retrieved infrastructure, including command-and-control details and Bitcoin wallet information fetched through **Pastebin**. Researchers said the campaign’s impact appeared limited because of narrow targeting and operational mistakes, but warned the same techniques could become far more dangerous if deployed at broader scale.
Aug 14, 2026
Researchers identified **Mantax Otax**, an Android hybrid spyware and ransomware family attributed to Indonesian threat actors and apparently targeting Indonesian users. Distributed through sideloaded APKs, it seeks device-administrator, sensitive runtime, and Accessibility permissions to gain extensive control, steal personal and communications data, capture screenshots and camera images, and—on Android 9 and earlier—encrypt user files with AES before demanding payment through an attacker-controlled chat interface. A newer **Mantax Otax v2** variant uses WebSockets to support persistent screen and application blocking, touch interception, overlay and dialog spam, jumpscare effects, and remote text-to-speech harassment. Its ability to capture GUI input and inject or interfere with user input aligns with mobile ATT&CK techniques `T1417.002` and `T1516`, increasing both the surveillance and coercive impact on compromised devices.
Sep 12, 2026