Most Internet users have visited sites online they’d rather not talk about — especially with their spouse, employer or law enforcement. But a new Android ransomware is playing “shame game” by sending fake FBI warning messages about illegal adult content to users’ mobile devices after they open an email attachment that supposedly contains an Abode Flash Player update. In fact, it’s a variant of the popular Android.Trojan.SLocker.DZ malware, and it’s part of a spam campaign now targeting English-speaking countries.

Flash Flood of Android Ransomware

According to SCMagazine, researchers from Bitdefender detected 15,000 emails sent from servers in Ukraine to users in English-speaking countries, with the largest number of messages sent to the U.S. The attached APK file seems to be a Flash update but actually infects the device with ransomware. Unlike similar malware used on PCs, this version doesn’t encrypt files but “succeeds in denying the users access to the device,” said Bogdan Botezatu of Bitdefender. By disabling the home and navigation keys, the Android ransomware restricts users to their home screen, which shows an FBI splash screen warning that they’ve broken the law by visiting adult websites and must pay a $500 fine using a valid MoneyPak voucher code. It gets worse: According to Bitterwallet, the malware also includes lewd screenshots it claims are from the user’s browser history.

Botezatu said the malware is extremely effective because it doesn’t require administrator permissions, making it easier to sneak by security apps. Even rebooting the device won’t work because the malware runs alongside any boot process, and attempting brute-force removal by entering invalid MoneyPak codes only ups the ransom to $1500. It’s no surprise that the U.S. is the hardest-hit area since Canadian and British users aren’t likely targets of the FBI just for looking at XXX content. But as noted by CSO Online, malicious actors have also created a similar version of this malware using Koler ransomware, which serves up a warning message and ransom demand from the Royal Canadian Mounted Police.

Payback Is an Option

Fortunately, there’s an alternative for users who don’t want to pay the fine or hand over their device to corporate IT for cleaning. It requires booting in Safe Mode. First, users need to press and hold the power button, then press and hold “power off.” This should offer a “reboot to safe mode” option, allowing users to open the application manager and remove the malware directly. Alternatively, it’s possible to connect the smartphone to a PC and remove the malware remotely so long as Android Debug Bridge is enabled on the mobile device.

Android ransomware is getting more sophisticated but continues to leverage the fear of shame or discovery to convince users they should pay up rather than risk embarrassment. While it’s possible to remove this malware after the fact with no harm done, it’s easier to avoid the problem altogether. G-, R- or XXX-rated content notwithstanding, opening unsolicited email attachments is always risqué.

More from

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…