May 27, 2015 By Douglas Bonderud 2 min read

Most Internet users have visited sites online they’d rather not talk about — especially with their spouse, employer or law enforcement. But a new Android ransomware is playing “shame game” by sending fake FBI warning messages about illegal adult content to users’ mobile devices after they open an email attachment that supposedly contains an Abode Flash Player update. In fact, it’s a variant of the popular Android.Trojan.SLocker.DZ malware, and it’s part of a spam campaign now targeting English-speaking countries.

Flash Flood of Android Ransomware

According to SCMagazine, researchers from Bitdefender detected 15,000 emails sent from servers in Ukraine to users in English-speaking countries, with the largest number of messages sent to the U.S. The attached APK file seems to be a Flash update but actually infects the device with ransomware. Unlike similar malware used on PCs, this version doesn’t encrypt files but “succeeds in denying the users access to the device,” said Bogdan Botezatu of Bitdefender. By disabling the home and navigation keys, the Android ransomware restricts users to their home screen, which shows an FBI splash screen warning that they’ve broken the law by visiting adult websites and must pay a $500 fine using a valid MoneyPak voucher code. It gets worse: According to Bitterwallet, the malware also includes lewd screenshots it claims are from the user’s browser history.

Botezatu said the malware is extremely effective because it doesn’t require administrator permissions, making it easier to sneak by security apps. Even rebooting the device won’t work because the malware runs alongside any boot process, and attempting brute-force removal by entering invalid MoneyPak codes only ups the ransom to $1500. It’s no surprise that the U.S. is the hardest-hit area since Canadian and British users aren’t likely targets of the FBI just for looking at XXX content. But as noted by CSO Online, malicious actors have also created a similar version of this malware using Koler ransomware, which serves up a warning message and ransom demand from the Royal Canadian Mounted Police.

Payback Is an Option

Fortunately, there’s an alternative for users who don’t want to pay the fine or hand over their device to corporate IT for cleaning. It requires booting in Safe Mode. First, users need to press and hold the power button, then press and hold “power off.” This should offer a “reboot to safe mode” option, allowing users to open the application manager and remove the malware directly. Alternatively, it’s possible to connect the smartphone to a PC and remove the malware remotely so long as Android Debug Bridge is enabled on the mobile device.

Android ransomware is getting more sophisticated but continues to leverage the fear of shame or discovery to convince users they should pay up rather than risk embarrassment. While it’s possible to remove this malware after the fact with no harm done, it’s easier to avoid the problem altogether. G-, R- or XXX-rated content notwithstanding, opening unsolicited email attachments is always risqué.

More from

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today