E-Business
ESET Researchers Spot DoubleLocker ‘Innovative’ Android Ransomware
By peter oluka
ESET researchers have spotted the first-ever ransomware misusing Android accessibility services. On top of encrypting data, it also locks the device.
Detected by ESET products as Android/DoubleLocker.A, the ransomware is based on the foundations of a particular banking Trojan, known for misusing accessibility services of the Android operating system.
However, DoubleLocker doesn’t have the functions related to harvesting users’ banking credentials and wiping out their accounts. Instead, it has received two powerful tools for extorting money from its victims.
DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem.
“Given its banking malware roots, DoubleLocker may well be turned into what could be called ransom-bankers. Two-stage malware that first tries to wipe your bank or PayPal account and subsequently locks your device and data to request a ransom… Speculation aside, we spotted a test version of such a ransom-banker in the wild as long ago as May, 2017,” comments Lukáš Štefanko, the ESET malware researcher who discovered DoubleLocker.
Distribution
DoubleLocker spreads in the very same way as its banking parent does. It is distributed mostly as a fake Adobe Flash Player through compromised websites.
Once launched, the app requests activation of the malware’s accessibility service, named “Google Play Service”. After the malware obtains the accessibility permissions, it uses them to activate device administrator rights and set itself as the default Home application, in both cases without the user’s consent.
“Setting itself as a default home app – a launcher – is a trick that improves the malware’s persistence. Whenever the user clicks on the home button, the ransomware gets activated and the device gets locked again. Thanks to using the accessibility service, the user doesn’t know that they launch malware by hitting Home,” explains Štefanko.
Locking Both Device And Data
DoubleLocker, once executed on the device, creates two reasons for the victims to pay.
First, it changes the device’s PIN, effectively blocking the victim from using it. The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device.
Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko.
The ransom has been set to 0.0130 BTC (approximately USD 54 at time of writing) and the message highlights that it must be paid within 24 hours. However, if the ransom is not paid, the data will remain encrypted and will not be deleted.
How To Get Rid Of It?
In the ransom note, the user is warned against removing or otherwise blocking DoubleLocker: “Without [the software], you will never be able to get your original files back”.
To prevent unwanted removal of the “software”, the crooks even recommend disabling the user’s antivirus software.
“Such advice is irrelevant: all those with a quality security solution installed on their devices are safe from DoubleLocker,” explains Štefanko.
The only viable option to clean the device of the DoubleLocker ransomware is via a factory reset.
For rooted devices, however, there is a method to get past the PIN lock without a factory reset. For the method to work, the device needed to be in the debugging mode before the ransomware got activated.
If this condition is met, then the user can connect to the device by ADB and remove the system file where the PIN is stored by Android. This operation unlocks the screen so that the user can access their device. Then, working in safe mode, the user can deactivate device administrator rights for the malware and uninstall it. In some cases, a device reboot is needed.
As for the data stored on the device, there is no way to recover it, as mentioned earlier.
“DoubleLocker serves as just another reason for mobile users to have a quality security solution installed, and to back up their data on a regular basis,” concludes Štefanko.
Kaspersky’s latest survey highlights a protection gap between macOS and Windows based devices. While macOS has long been regarded as the more secure operating system, 12% of its users reported malware infections compared with 9% of Windows users. Moreover, only 35% of macOS owners install dedicated security software, versus 42% of Windows users.
According to Kaspersky’s latest global survey*, Windows users report a higher adoption rate for most security measures, while macOS users show a modest advantage in a few privacy‑focused actions. At the same time, during the past year macOS users reported higher percentages than Windows users for a number of cybersecurity incidents.
The largest gap in cybersecurity approaches appears in the habit of not opening suspicious emails or links, with 62% of Windows users following this practice compared to 51% of macOS users.
What’s more, when it comes to cybersecurity software installation, macOS users are also lagging behind. While among Windows users 42% reported using digital‑life‑protection software, for macOS this rate is only 35%, what Kaspersky security experts call a worryingly low figure.
It is noteworthy that 12% of macOS respondents said they fell victim to phishing (fake emails, websites or messages) over the past year compared with 9% of Windows users. Moreover, during this period macOS users faced more scams and investment frauds (16% vs 13%), privacy violations (11% vs 8%) and thefts of personal data (12% vs 7%).
To counter these specific threats, robust anti-malware and anti-phishing protection is essential. Malware authors put a lot of effort into developing new, more powerful and stealthier versions of stealers, spies and other classes of malicious payloads, while relying on phishing techniques that allows them to get access to user’s data.
Dedicated security solutions add a crucial layer of real-time detection and defence that complements macOS’s built-in protection – and independent tests have repeatedly shown that effective options, such as Kaspersky Premium for macOS, deliver strong protection. In 2025, AV-TEST recognised it as the top-performing macOS security solution based on consistent, reliable results across a full year of evaluations.
When it comes to credentials and passwords safety, Windows users also show better security practices’ adoption rates. They lead in using a unique password for each account (38% vs 35%) and complex passwords (52% vs 45%), two‑factor or multi‑factor authentication (51% vs 46%).
Adopting a dedicated password manager becomes a logical next step. Such tools store all credentials in a secure vault protected by a single master password, eliminating the need to remember hundreds of passwords while keeping them safe from breaches.
They also support modern authentication methods like passkeys, enabling seamless, single-tap sign-in across all devices through secure synchronisation – capabilities offered by solutions such as Kaspersky Password Manager.
“There are entrenched stereotypes that macOS is inherently more secure because its user base is smaller, leading cyber‑criminals to deem it a lower‑value target, or because the platform itself includes many robust security features. While these observations are not entirely unfounded, the threat landscape has evolved dramatically.
Attackers actively employ phishing and commit supply chain attacks, which often allow them to affect users of any operating system in a single malware campaign. Moreover, mac specific malware is not rare and there are many malware families that target macs exclusively. Consequently, any device with an Internet connection, regardless of its operating system or form factor, requires cybersecurity software to defend against a wide range of cyber threats,” comments Sergey Puzan, cybersecurity expert at Kaspersky.
E-Business
Cyber Resilience a Critical Priority for Manufacturing Amid Rapid Digitalization – Report Shows
As 60% of manufacturers race toward full digitalisation, cyber risk is increasingly manifesting as a business risk, according to a new global report by Kaspersky and VDC Strategy.
This means cybersecurity is not merely a compliance function, it is a cornerstone of production assurance, safeguarding uptime, quality, and operational continuity.
Manufacturers are modernising to deliver safer, more consistent and more cost-effective production and digitalization is moving fast: just 9% of organisations describe themselves as fully digital today, but 60% expect to get there within two years, according to the joint report by Kaspersky and VDC, titled ‘Cyber Resilience, Built for Manufacturing’.
That shift links shop-floor equipment, production lines and site operations to platforms such as Manufacturing execution systems (MES), Supervisory control and data acquisition (SCADA) and historians, turning many plants into cyber-physical systems (CPS), where a digital disruption doesn’t stay digital. It can slow production lines, quarantine work in progress, invalidate traceability records, or halt production outright.
What’s driving manufacturing digitalization?
Manufacturers are digitising for measurable operational gains, not novelty. Survey respondents identified the primary drivers of their digital transformation strategy as:
- Improving production output or efficiency (24%)
- Reducing operational or production expenses (15%)
- Enabling new strategic opportunities (14%)
- Improving cyber resilience (13%)
The same connected systems that unlock these gains, including MES, IIoT sensors, automated material handling, remote engineering access, also become the systems that determine whether production can be trusted to keep running.
Cyber risk is now a business risk
Cyber risk has evolved from a mere IT concern to a direct threat to revenue generation, as environments transform into cyber-physical systems. In these integrated settings, digital disruptions like malware no longer just affect data, they can cause unsafe operations, scrapped batches, and halted production on the plant floor. This shift highlights the urgent need to treat cybersecurity as a key part of operational resilience.
According to the report, nearly 60% of manufacturing organisations estimate that cyber incidents cause damages exceeding $1 million per event, with an average disruption of 15.3 hours. The most significant losses often result from production halts, missed delivery commitments, and penalties, rather than just forensic costs.
In this context, downtime links cybersecurity risks to overall business performance. Cyber incidents can reduce Overall Equipment Effectiveness (OEE), strain staffing, and disrupt supply chains. Recovery involves more than system restore, it requires re-establishing confidence in process parameters, quality records, and traceability before resuming operations.
Mature cybersecurity programs now incorporate OT security into governance, focusing on metrics valued by production leaders such as time to restore, backup confidence, legacy asset coverage, and safe degraded operation. This alignment ensures cybersecurity supports continuous production and resilience, not just IT compliance.
However, challenges remain due to split ownership. While 59% of organisations’ IT departments manage security policies, these often overlook plant realities. Managing many security tools (44%) and OT patching issues (38%) show that cybersecurity must be embedded into daily routines of production, engineering, and quality teams. Only through such integration can cybersecurity effectively enhance operational reliability and defend against evolving threats.
“As manufacturing environments become increasingly interconnected, cybersecurity shifts focus from merely adding protective layers to ensuring the availability, resilience, and integrity of production processes. The goal is to minimise operational impact and speed up recovery, rather than solely preventing intrusions.
“Kaspersky offers a unified ecosystem that integrates IT, OT, and IIoT security, empowering manufacturers to pursue digital transformation securely. This strategy helps maintain operational continuity and reduces long-term cybersecurity costs,” comments Andrey Strelkov, Head of Industrial Cybersecurity Product Line at Kaspersky.
To implement this strategy, manufacturing companies can leverage solutions from the Kaspersky OT Cybersecurity Ecosystem, centered around Kaspersky Industrial CyberSecurity (KICS), a native Extended Detection and Response platform designed for critical infrastructure protection. KICS enables centralised detection and response to complex attacks across the entire industrial network, ensuring comprehensive visibility and security.
Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws involving students’ personal information.
The investigation follows public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis.
Dr Vincent Olatunji, national commissioner and chief executive officer of the NDPC, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, processing, use and disclosure of the affected students’ personal data.
The investigation will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged processing of the data.
According to the Commission, the investigation will assess the data protection compliance obligations of the parties under the Nigeria Data Protection Act, 2023 (NDP Act), as well as potential risks posed to the rights and freedoms of the affected data subjects.
The NDPC said the probe would cover several areas, including Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring or profiling activities, and the use of automated decision-making systems.
It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation and purpose limitation.
Other areas include data retention policies and the adequacy of technical and organisational measures put in place to safeguard the rights and personal data of affected students.
The Commission reiterated that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
The NDPC therefore warned educational institutions that are yet to comply with its existing data protection compliance directives to take immediate steps to achieve compliance.
The Commission said it would continue to exercise its regulatory mandate to protect the privacy rights of Nigerians and ensure that organisations processing personal data comply with the provisions of the Nigeria Data Protection Act, 2023.
Airtel Nigeria Adds Over 1,000Cell Sites in Nationwide Expansion to Surpasses 17,000
MacOS Users Report More Cyber Threats than Windows Users – Survey Reveals
Mastercard, TeamApt Collaborate to Expand Digital Payments Across Africa
Access Holdings Sets New Benchmark in Nigeria’s Finance Talent Pipeline
ESUT Workers Get N82,000 Minimum Wage as Enugu Approves Fresh Salary Increase
EFCC Busts NIS Visa Overstay Racket, Uncovers N700m in an Account
Fact-Check: Elon Musk’s “Tesla Pi Phone” is Internet Rumor
NBC Tasks Broadcasting Stations over 2028 DSO Global Deadline
NBC Scraps Annual Digital Access Fee on DSO
Glo Sponsored African Voices to Feature Netflix’s “The Polygamist” Stars
Telecom3 days agoipNX Joins Calls for Innovation-Friendly Ecosystem and Stronger Local Opportunities at Regenesys AI Summit
E-Business3 days agoNDPC Probes UNILAG, Lotus Bank, Hackerbella over Alleged Students’ Data Misuse
E-Financial3 days agoKudiWave Asks for Clarification over N750m Transfer from PalmPay Account
News3 days agoPalmPay Reinforces Commitment to Youth Empowerment on International Youth Day
Telecom3 days agoNCC Reports over 5,000 Fibre Cuts in 6 Months
Telecom3 days agoGoogle Selects Six Nigerian News Creators for Emerging Voices Growth Lab
E-Financial3 days agoNigerians Borrow More to Buy Homes as Mortgage Demand Climbs – CBN
General News3 days agoNUPRC Warns of Counterfeit, AI-Generated Appointment Letters