CyberCertPrepMobile Security FundamentalsMobile Threats & MalwareEASYFree question
A helpdesk technician investigates a report where an employee's Android phone shows a persistent full-screen overlay claiming the phone is locked due to illegal content and demanding a $200 gift card payment. The legitimate UI is completely inaccessible. What type of malware causes this behavior?
- A.A. Banking Trojan with overlay capability
- B.B. Mobile ransomware/locker using SYSTEM_ALERT_WINDOW or device admin privileges to display a persistent lock screen
- C.C. A stalkerware app that mistakenly activated its remote lock feature
- D.D. A WAP billing subscription that triggered a screen lock as a penalty for non-payment
Why B is correct
Mobile locker ransomware displays a persistent full-screen overlay or abuses device admin privileges to prevent the user from accessing the device UI until a ransom is paid. It uses SYSTEM_ALERT_WINDOW, device administrator APIs, or (on older Android) abuses the lock screen APIs. This is distinct from banking Trojans (which target financial apps specifically), stalkerware (passive monitoring), and WAP billing scams (financial, not UI-locking).
Know someone studying for Mobile Security Fundamentals? Send them this one.