Skip to content
DoubleLocker: New Android Ransomware Encrypts Files and Locks Devices

DoubleLocker: New Android Ransomware Encrypts Files and Locks Devices

First seen 18 Oct 2026, 01:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 02:09 UTC
  • •DoubleLocker encrypts files and changes device PINs, locking users out.
  • •It spreads through fake Adobe Flash Player downloads on compromised sites.
  • •Victims face a 24-hour deadline to pay the ransom or lose data access.

DoubleLocker is a newly discovered Android ransomware that encrypts user files and changes device PINs, making recovery difficult. Detected by ESET, it is based on the BankBot trojan and spreads via fake Adobe Flash Player downloads from compromised sites. Once activated, it requests permission to enable its accessibility service, which allows it to lock users out of their devices while demanding a ransom of 0.0130 bitcoins (approximately $74). Users have a 24-hour deadline to pay or risk losing access to their data permanently. Notably, while it has banking malware roots, it currently lacks the capability to harvest banking credentials. Recovery options are limited to factory resets unless specific conditions are met. The threat is particularly concerning for Android users due to the infrequency of security updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
DoubleLocker ransomware discovered
ESET researchers identified DoubleLocker, which encrypts files and locks devices, marking a new threat in the Android ecosystem.
Neoteo
2026-10-18
Official announcement of DoubleLocker
ESET confirmed the ransomware's capabilities and its distribution method, emphasizing its dual attack on devices.
www.welivesecurity.com

More articles in this cluster (2)

Following this threat?

Track DoubleLocker and BankBot in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

How does DoubleLocker spread?
DoubleLocker is primarily distributed as a fake Adobe Flash Player through compromised websites.
What can victims do to recover their data?
Victims may need to perform a factory reset, as there are limited recovery options unless specific conditions are met.
Is there any way to prevent infection?
Users should avoid downloading apps from untrusted sources and be cautious with permissions requested by apps.