Introduction

The cybersecurity landscape is experiencing a growing attention for malware threats. The latest examples are the growth of ransomware use, which allows attackers to get paid for releasing encryption keys.

DroidLock is another example of this phenomenon, an Android-specific malware that can steal data and lock the device until a ransom is paid. DroidLock was first identified in December 2025 on Android devices with OS version 11 or earlier.

Technical Details

• Functionality: when installed on the device, DroidLock performs a backup of stored data on the screen, then encrypts the data and displays a fake lock screen with a ransom demand of $50 in Bitcoin, unless the user pays within 72 hours.

• Code Source: The available malware version online has been identified as an Android ransomware variant, with base codes similar to previous examples. The source of the malware has not yet been confirmed.

• Performance: The malware can lock the device until payment is made.