As people around the world get more desperate for information on the spread of the coronavirus, there is a high chance that people out there will look to profiteer from an information vacuum. According to a new report, one Android app masquerading as a coronavirus update application is in fact ransomware.
According to security firm DomainTools there is an app called “CovidLock” that claims to be a coronavirus tracking app but is actually ransomware, that will actually just lock your device.
DomainTools found that CovidLock — which can be downloaded at coronavirusapp[.]site — poses as a coronavirus tracking app and when installed prompts you to give accessibility and lock screen permissions.
This then lets CovidLock essentially lock your device, the criminals behind the app then hold you ransom for $100 in Bitcoin with threats of deletion of any personal data and social media accounts on your device unless the payment is made within 48 hours.
It should be noted that since Android Nougat has rolled out, there is protection in place against this type of attack. However, it only works if you have set a password. If you haven’t set a password on your phone to unlock the screen, you’re still vulnerable to the CovidLock ransomware.
However, DomainTools notes that builds newer than Android Nougat are able to protect your device from these types of screen-lock attacks. They do mention that not having a lock screen passcode does mean protections are not valid and if installed you will have problems.
Luckily, the team at DomainTools has reverse-engineered the decryption keys that the CovidLock app will ask for to then give you back control of your device. A Redditor has also posted the passcode just in case anyone you know has been affected and is being held to ransom.
It’s also an important time to note that many apps and sites may attempt to take advantage of people seeking information about the coronavirus. Our advice is to only stick to sites and services from official news and government agencies to ensure that these insidious kinds of malware are avoided and nullified.
