Total Takeover: DroidLock Hijacks Your Device

zLabs researchers identified a new Android ransomware campaign, DroidLock, that spreads via phishing sites and uses a dropper to install a secondary payload which abuses Accessibility and Device Admin permissions to fully takeover devices. The malware supports overlays to steal credentials and lock patterns, screen recording, VNC remote control, and communicates with C2 servers over HTTP and websockets. #DroidLock #Zimperium

Keypoints

DroidLock is delivered via phishing websites using a dropper that installs a secondary payload to bypass Android restrictions and obtain Accessibility permissions.
Once granted Accessibility, the malware auto-approves additional permissions (SMS, call logs, contacts, audio) enabling broad data access and persistence.
The malware uses HTTP for initial device info exfiltration and websockets for bidirectional C2 command/control, supporting 15 distinct commands from the attacker.
Ransomware-like behavior includes full-screen scary overlays, fake system update screens, device wipe capability, PIN/biometric changes, and permanent lockout via Device Admin abuse.
Credential theft is performed via two overlay mechanisms: an in-memory fast lock-pattern overlay and WebView overlays that render attacker-controlled HTML from a local database.
Advanced collection features include persistent screen recording (MediaProjection), camera capture, SMS interception, clipboard theft, keylogging, audio capture, and location tracking.
Zimperium’s on-device dynamic detection (MTD / zDefend) detected all samples in a zero-day fashion, and protection is recommended for enterprise devices.

MITRE Techniques

[T1660 ] Phishing – Malware spread via phishing websites hosting malicious APKs. (‘Adversaries host phishing websites to spread malicious Apk’s’)
[T1624.001 ] Event Triggered Execution: Broadcast Receivers – Creates broadcast receiver to receive SMS events and other triggers. (‘It creates a broadcast receiver to receive SMS events’)
[T1626.001 ] Abuse Elevation Control Mechanism: Device Administrator Permissions – Requests Device Admin to wipe, lock, and change PINs. (‘Malware is capable of factory reset, Disable lockscreen’)
[T1655.001 ] Masquerading: Match Legitimate Name or Location – Uses legitimate-looking app names (e.g., “Orange”) to disguise itself. (‘Malware pretending to be apps such as Orange’)
[T1629.002 ] Device Lockout – Uses DevicePolicyManager.lockNow() and admin privileges to lock out victims. (‘Malware can lockout victim through the device by DevicePolicyManager.lockNow()’)
[T1516 ] Input Injection – Mimics user interaction to perform clicks, gestures, and inject pattern overlays to steal credentials. (‘Malware can mimic user interaction, perform clicks and various gestures, and input data’)
[T1517 ] Access Notifications – Intercepts notifications and OTPs via NotificationListenerService. (‘The malware leverages Android NotificationListenerService to intercept OTPs’)
[T1414 ] Clipboard Data – Extracts data from the clipboard for credential/exfiltration. (‘It extracts data stored on the clipboard’)
[T1417.001 ] Input Capture: Keylogging – Keylogger capability to capture keystrokes. (‘It has a keylogger feature’)
[T1417.002 ] Input Capture: GUI Input Capture – Captures displayed UI and overlays fraudulent screens to harvest credentials. (‘It is able to get the shown UI.’)
[T1430 ] Location Tracking – Tracks victim location as part of discovery/collection. (‘Location Tracking – Malware can track the victim’s location’)
[T1418 ] Software Discovery – Enumerates installed applications (package list). (‘Malware collects installed application package list’)
[T1426 ] System Information Discovery – Collects basic device information for analytics and profiling. (‘The malware collects basic device info.’)
[T1513 ] Screen Capture – Records screen content via MediaProjection and VirtualDisplay and sends base64 JPEGs to C2. (‘Malware can record screen content’)
[T1512 ] Capture Camera – Opens camera to take pictures (front camera capture for victim image). (‘Malware opens camera and takes pictures’)
[T1429 ] Audio Capture – Captures or mutes audio as part of attack operations. (‘Malware can mute the device’)
[T1636.004 ] Protected User Data: SMS Messages – Steals SMS messages including OTPs. (‘Steals SMSs from the infected device’)
[T414 ] Clipboard Data – Ability to steal clipboard contents referenced again in collection context. (‘It has the ability to steal data from the clipboard’)
[T1481.002 ] Web Service: Bidirectional Communication – Uses websocket for two-way C2 communication to receive commands and send data. (‘It uses websocket communication to poll the TA’s server and get the commands to execute.’)
[T1646 ] Exfiltration Over C2 Channel – Sends exfiltrated data (screenshots, SMS, clipboard) over C2 channels. (‘Sending exfiltrated data over C&C server’)
[T1582 ] SMS Control – Reads and sends SMS as part of control and data theft. (‘It can read and send SMS’)

Indicators of Compromise

[File names ] Dropper and secondary APKs used in infection chain – “dropper APK”, “secondary payload APK” (used to install DroidLock and bypass restrictions)
[Package names ] Targeted application package names used for overlays and lock-pattern theft – examples include apps used for masquerade like “Orange” and server-provided target package names stored via APP_BLOCK/APP_BLOCK_LOCK_PATTERN
[Network C2 ] HTTP analytics endpoint and websocket command channel used for C2 (endpoints not listed in article) – “HTTP analytics endpoint”, “websocket command URL” (full endpoints available in referenced repository)
[Screen captures ] Exfiltrated screenshots encoded as base64 JPEGs – “base64-encoded JPEG screen images” (sent to C2 via MediaProjection pipeline)
[SMS / Notifications ] Intercepted SMS and notification OTPs – “captured OTPs via NotificationListenerService”, “stolen SMS messages” (used for account takeover)
[Database entries / HTML ] Local database entries storing attacker-controlled HTML overlays – “stored HTML for WebView overlays”, “overlay entries mapping package names to HTML”

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print