If you use an Android device, you could be the target of new malware called DroidLock. According to mobile security firm Zimperium, the malware uses a convincing but fake system update prompt to take over devices and lock users out until they pay up. Researchers at Zimperium’s zLabs say DroidLock spreads through phishing websites, distributing fake Android apps to Spanish-speaking users. But it has the potential to spread to anyone in the future.
How DroidLock Works
DroidLock is essentially ransomware that hijacks your phone and demands payment within 24 hours. Victims are warned that their files will be deleted if they don’t comply, and are even told not to contact law enforcement or attempt recovery on their own.
DroidLock doesn’t encrypt your files, as typical ransomware does. Instead, it locks you out of your device entirely. According to zLabs, the malware can customize the lock screen, block access to the phone, and carry out admin-level actions, like deleting files or triggering a factory reset. It can even activate the front camera to see whether the victims are cooperating or trying to fix it on their own.
Read more: Phony Amazon Deal Links Are Everywhere Right Now
Designed to get around Android’s built-in protections, DroidLock disguises itself as a legitimate app and quietly delivers a second, more dangerous payload after installation. Next comes the real danger: The malware asks for Accessibility permissions. If granted, DroidLock can automatically approve additional app permissions on its own. From there, it has full control – enabling it to lock the phone, display ransom messages, mute alerts, access the camera, and wipe data.
How to Protect Your Android Device
- Avoid phishing sites that may host malware by not clicking links in emails or text messages. Instead, go to the sites directly in your web browser or use a site's mobile app. Also, double-check the URLs you type into a browser. Phishing sites often use URLs with slight typos of the legitimate ones.
- Make sure that Google Play Protect is turned on. To do so, open the Google Play app, tap your profile picture or icon, then tap Play Protect > Scan, to see if any harmful apps have already been installed. (This is the typical sequence, based on Android 16.) If so, follow our steps to remove the malware immediately. Then, from Play Protect, click the gear icon and toggle on "Improve harmful app detection" if it's not already enabled.
- Ensure you have safe software by keeping your Android operating system up to date (Settings > System > Software updates). Also, download apps only from the Google Play store where they have been vetted by Google's security experts.
- Be cautious with granting Accessibility permissions when installing apps, which you can review under Settings > Accessibility. These permissions are typically for tools for users with specific needs (such as disabilities), not most everyday apps.
- Consider adding antimalware. Major security software providers such as Avast, Bitdefender, Norton, and AVG provide Android security apps that score highly on independent evaluations. These are paid-for apps, but the makers may offer limited free options.
Read more: Android 16 Rolls Out Top-Level Protection for Everyone
Bottom Line
DroidLock may have started by targeting Spanish-speaking users, but anyone with an Android phone could be at risk. The malware can lock you out of your device and pressure you into paying a ransom. To stay safe, avoid unknown links, download apps only from Google Play, enable "Improve harmful app detection," think hard before granting Accessibility permissions, and install an antimalware app.
[Image credit: Techlicious via Nano Banana Pro]
