Mobile security firm Zimperium has identified DroidLock, Android malware that can lock users out of their phones, steal credentials and erase device data. The campaign was targeting Spanish-speaking users through malicious websites promoting fake apps, according to findings reported in December 2025 by BleepingComputer.
Zimperium said the version it analyzed does not encrypt files. Instead, it can display a ransom demand, block access to the phone and wipe the device.
The ransom message appears in a full-screen WebView overlay when the malware receives a command from the attacker’s server. It instructs victims to contact a Proton Mail address and provide their device ID. The attacker demands payment within 24 hours and threatens to permanently destroy the phone’s files if the victim does not comply, BleepingComputer reported.
Fake updates and permission abuse
According to Zimperium, infection begins with a dropper app that deceives the user into installing a second component containing DroidLock. BleepingComputer reported that the malicious apps impersonate legitimate software packages and introduce the payload through an update request.
The malware requests Device Admin and Accessibility Services permissions. Once a user grants accessibility access, Zimperium said, DroidLock automatically approves additional permissions to access text messages, call logs, contacts and audio.
The researchers reported that the malware can abuse device administrator privileges to lock the phone or erase its data through a factory reset. They also described its ability to change the PIN, password or biometric information to prevent the owner from accessing the device.
Zimperium identified 15 commands supported by DroidLock. These include displaying notifications and overlays, muting the device, activating the camera, uninstalling apps and initiating a factory reset.
Remote control and credential theft
DroidLock supports screen streaming and remote control through Virtual Network Computing, or VNC, according to Zimperium. The researchers also described a screen-recording function that captures images of the display and transmits them to a remote server.
The malware uses overlays to steal unlock patterns and app credentials. One presents a counterfeit pattern-entry interface, while another displays attacker-controlled HTML over targeted apps. BleepingComputer reported that patterns entered into the cloned interface are sent to the attacker.
A separate overlay imitates an Android system update and tells victims not to power off or restart their phones. Zimperium said this technique is used to prevent user interaction while malicious activity continues in the background.
BleepingComputer reported that Google Play Protect detects and blocks DroidLock on up-to-date devices. The publication linked that protection to Zimperium’s sharing of malware findings with Google’s Android security team through the App Defense Alliance.