DroidLock malware locks you out of your Android device and demands ransom

DroidLock is a new Android malware campaign that takes over a device and holds it for ransom, with early activity centred on Spanish-speaking users. It arrives via phishing sites that convince victims to install a dropper masquerading as a telecom provider or familiar brand, after which it gains control through abused Device Admin and Accessibility Services permissions.

Once granted, the malware can automatically approve further permissions, access SMS, call logs, contacts, and audio, and uses Accessibility Services to create overlays on other apps to capture unlock patterns and display a fake Android update screen. It also uses Virtual Network Computing for remote access and real-time control, enabling actions such as starting the camera, muting sound, and uninstalling apps, and can deny access by changing the device PIN.

According to Zimperium, DroidLock can wipe devices, change PINs, intercept OTPs and remotely control the user interface, and while it does not encrypt files, it achieves a similar outcome by locking users out unless a ransom is paid. Researchers warn the campaign could spread to other countries if successful, highlighting the need to install apps only from official stores and scrutinise app permissions. 11 December 2025