Android users have a new threat to worry about. Security researchers have uncovered a powerful piece of malware dubbed DroidLock that can lock victims out of their phones for ransom, siphon off sensitive data, and even wipe devices entirely.
According to mobile security firm Zimperium, DroidLock is currently targeting Spanish-speaking users through malicious websites pushing fake apps that masquerade as legitimate packages. Once installed, the malware gives attackers deep, almost remote-desktop-level control over the infected device.
How DroidLock infects your phone
The attack doesn’t start with the full malware right away. Instead, the victim first downloads a dropper app from a rogue site. That dropper then tricks the user into installing a so-called “update” or secondary component – the part that actually contains DroidLock.
After landing on the device, the malicious app quickly requests two powerful sets of permissions:
- Device Admin – typically used for things like corporate device management
- Accessibility Services – often abused by malware to tap and swipe on your behalf
If the user grants these, DroidLock can:
- Wipe the phone or trigger a factory reset
- Lock the screen on demand
- Change the device PIN, password, or biometric data to keep the owner out
- Quietly run background actions with little chance of being interrupted
On top of that, the malware can access text messages, call logs, contacts, and audio recordings, giving attackers both control and visibility into the victim’s life.
Remote control via VNC and screen overlays
One of DroidLock’s most dangerous features is its ability to give the attacker full remote control. Zimperium’s analysis shows the malware using a VNC-style screen-sharing system, letting the operator see and interact with the device in real time.
To make that access even more powerful, DroidLock deploys overlays – fake screens that sit on top of legitimate apps and system interfaces. These overlays allow it to:
- Steal the device’s lock pattern by imitating the Android lock screen
- Capture app-specific unlock patterns and passwords
- Block the user from interacting with certain apps while the attacker works in the background
When the victim enters their lock pattern on the cloned interface, the pattern is sent straight to the attacker. That way, they can unlock the device remotely whenever it’s idle and continue snooping or making changes via VNC.
Ransomware behavior without encryption
Zimperium says DroidLock supports 15 different commands from its command-and-control (C2) server, including options to:
- Show notifications
- Place an overlay on the screen
- Mute the device
- Start the camera
- Uninstall apps
- Reset the phone to factory settings
The most visible of these is a ransomware-style overlay delivered via WebView. When the operator triggers the ransom command, the victim suddenly sees a full-screen message demanding payment and instructing them to contact the attacker at a Proton Mail address.
The message warns that if the ransom isn’t paid within 24 hours, the attacker will permanently destroy the phone’s files.
Importantly, Zimperium clarifies that DroidLock does not actually encrypt files the way classic ransomware does. Instead, it leans on its ability to:
- Change the lock code or biometric settings
- Wipe or factory-reset the device
By threatening data destruction and blocking access to the phone, the malware achieves the same pressure as traditional ransomware without the overhead of encryption.
Who’s being targeted
So far, the campaign appears to focus on Spanish-speaking users, particularly those browsing to malicious or compromised websites that promote fake apps. The apps impersonate legitimate packages, making them easier to trust at a glance.
Because distribution happens outside the official Google Play store, the usual app-review checks don’t apply. Users who frequently side-load APKs from untrusted sources are at much higher risk.
What Google and Zimperium are doing about it
Zimperium is a member of Google’s App Defense Alliance, a collaboration between Google and security partners to spot new Android threats. As part of that partnership, Zimperium shares malware samples like DroidLock with Google’s Android security team.
Google can then update Google Play Protect so it can detect and block this malware on up-to-date devices, even if the malicious app didn’t come from the Play Store. That protection isn’t perfect – it still depends on users keeping Play services current – but it gives Google a way to respond quickly as new families of malware show up in the wild.
How to protect yourself from DroidLock
The usual Android security hygiene goes a long way here:
- Avoid side-loading APKs from random websites or links in messages. If you must install something from outside Google Play, make sure it comes from a genuinely trusted publisher.
- Scrutinize permissions. Be extremely cautious about granting Device Admin or Accessibility Services to non-system apps, especially ones you just installed.
- Keep Play Protect on and updated. Regularly run a Play Protect scan and keep Google Play services up to date so new malware signatures apply to your device.
- Back up important data. Regular cloud or offline backups reduce the leverage attackers have if they manage to lock or wipe your phone.
DroidLock is a reminder that ransomware has firmly arrived on mobile. It doesn’t need fancy file encryption when it can simply lock you out of your own device. Staying inside trusted app stores, watching permissions, and leaning on Play Protect are still your best defenses against threats like this.