According to DomainTools senior security engineer Tarik Saleh, the number of coronavirus-themed domain registrations increased following reports of the first cases of COVID-19, and many of these are allegedly scams.<\/p>\n
One particular platform, coronavirusapp[.]site, is prompting users to install an Android application for real-time updates on the pandemic. Instead, the app comes bundled with a ransomware aptly called CovidLock.<\/p>\n
CovidLock asks for permission to access the lock screen. It then employs a technique known as screen-lock attack, which holds the phone hostage by blocking user access.<\/p>\n
The ransomware threatens to erase contacts, pictures and videos on the infected device, as well as leak the victims social media account information and wipe all phone data unless a ransom of $100 is paid in Bitcoin within 48 hours.<\/p>\n
Saleh says phones running on the latest Android versions should be fine if the user set a password to unlock the screen.<\/p>\n
Since Android Nougat has rolled out, there is protection in place against this type of attack. However, it only works if you have set a password. If you havent set a password on your phone to unlock the screen, youre still vulnerable to the CovidLock ransomware.<\/p>\n
DomainTools researchers say theyve already reverse-engineered the decryption key and plan to share it publicly. They are also monitoring the transactions in the Bitcoin wallet used by the ransomware.<\/p>\n
Featured Image: Shutterstock\/Immersion Imagery<\/p>\n
<\/p>\n