CyberCertPrepMobile Security FundamentalsMobile Threats & MalwareEASYFree question
A helpdesk technician investigates a report where an employee's Android phone shows a persistent full-screen overlay claiming the phone is locked due to illegal content and demanding a $200 gift card payment. The legitimate UI is completely inaccessible. What type of malware causes this behavior?
- A.A banking Trojan with an overlay capability that has been pointed at the launcher rather than at a particular bank client
- B.A stalkerware app that mistakenly activated its remote lock feature
- C.A subscription scam that triggered a screen lock after nonpayment
- D.Mobile ransomware/locker using SYSTEM_ALERT_WINDOW or device admin privileges to display a persistent lock screen
Why D is correct
Mobile locker ransomware displays a persistent full-screen overlay or abuses device admin privileges to prevent the user from accessing the device UI until a ransom is paid. It uses SYSTEM_ALERT_WINDOW, device administrator APIs, or (on older Android) abuses the lock screen APIs. This is distinct from banking Trojans (which target financial apps specifically), stalkerware (passive monitoring), and WAP billing scams (financial, not UI-locking).
Know someone studying for Mobile Security Fundamentals? Send them this one.