Sunday, March 16, 2025
HomeMalwareA Mobile Ransomware Called "LeakerLocker" Found in Google Play Store Which ...

A Mobile Ransomware Called “LeakerLocker” Found in Google Play Store Which Leaks Phone’s Sensitive Information and Demand to Pay

Published on

SIEM as a Service

Follow Us on Google News

Mobile Ransomware called LeakerLocker Found in Google Playstore which infect the Android Mobile user and steals the information such as contact Phone numbers, Phone call History, personal images and Email texts etc.

This Ransomware will be Encrypt the file instead of that, this malware Demand a payment to prevent the attacker from spreading a victim’s private information.

Once LeakerLocker Ransomware attacks the Victims, it takes unauthorized backup of the victims personal information and that could be leaked if victims denied paying the demanded ransom Payment.

Source : McAFee

Once Victim infected, its asks to inputs a credit card number and clicks “Pay,” the code send a request to the payment URL with the card number as a parameter.

After payment successfully initiated it gives a reply that,“our [sic] personal data has been deleted from our servers and your privacy is secured.” If not successful, it shows “No payment has been made yet. Your privacy is in danger.” 

Malicious Applications in PlayStore

McAfee  Researchers Found 2 Malicious applications in Google Playstore which infected by this  LeakerLocker Ransomware.

1.Wallpapers Blur HD

This Malicious Wallpaper Application Found Google Play Store  that users always complains that , Playstorewhenever installing the Application it always Asking some sensitive Permissions such as calls, reading and sending SMS, access to contacets, etc.

This Applications hide a Malicious Payload inside of the Apps. once install into the Victims Machine it automatically execute the payload and force the victims to allow all the sensitive permisssion.

According to MacFee ,It has been downloaded between 1,000 and 5,000 times. Its rating is 4.5, much higher than Wallpaper’s 3.6.

Also Read  Android Trojan Called “SpyDealer” Spying on More Than 40 Apps Including Facebook, WhatsApp, Skype,Telegram

Booster & Cleaner Pro

This Malicious Applications downloaded between 1,000 and 5,000 times iPlay storeand it have some positive reviews.

Positive Rewviews are not a safety indicator because fake reviews are very common in fraudulent apps.

“At first execution, the malware displays typical functions of Android boosters. Due to the nature of this kind of application, users could be more willing to allow access to almost any permission”

LeakerLocker locks the home screen and accesses private information in the background thanks to its victims granting permissions at installation time.

McaFee Reported this Malicious Activities to Google and Belives that this Applications will be removed form PlayStore as soon as Possible.

Also Read Android Malware Called “CopyCat” Infected Around 14 Million Android Devices and Gained over $1.5 Million

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploiting Exposed Jupyter Notebooks to Deploy Cryptominers

Cado Security Labs has identified a sophisticated cryptomining campaign exploiting misconfigured Jupyter Notebooks, targeting...

AWS SNS Exploited for Data Exfiltration and Phishing Attacks

Amazon Web Services' Simple Notification Service (AWS SNS) is a versatile cloud-based pub/sub service...

Edimax Camera RCE Vulnerability Exploited to Spread Mirai Malware

A recent alert from the Akamai Security Intelligence and Response Team (SIRT) has highlighted...

Cisco Warns of Critical IOS XR Vulnerability Enabling DoS Attacks

Cisco has issued a security advisory warning of a vulnerability in its IOS XR...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

DeepSeek R1 Jailbreaked to Create Malware, Including Keyloggers and Ransomware

The increasing popularity of generative artificial intelligence (GenAI) tools, such as OpenAI’s ChatGPT and...

Ongoing Cyber Attack Mimic Booking.com to Spread Password-Stealing Malware

Microsoft Threat Intelligence has identified an ongoing phishing campaign that began in December 2024,...

North Korean Hackers Use Google Play Malware to Steal SMS, Calls & Screenshots

Cybersecurity researchers at Lookout Threat Lab have uncovered a sophisticated Android surveillance tool dubbed...