Most Internet users have visited sites online they’d rather not talk about — especially with their spouse, employer or law enforcement. But a new Android ransomware is playing “shame game” by sending fake FBI warning messages about illegal adult content to users’ mobile devices after they open an email attachment that supposedly contains an Abode Flash Player update. In fact, it’s a variant of the popular Android.Trojan.SLocker.DZ malware, and it’s part of a spam campaign now targeting English-speaking countries.

Flash Flood of Android Ransomware

According to SCMagazine, researchers from Bitdefender detected 15,000 emails sent from servers in Ukraine to users in English-speaking countries, with the largest number of messages sent to the U.S. The attached APK file seems to be a Flash update but actually infects the device with ransomware. Unlike similar malware used on PCs, this version doesn’t encrypt files but “succeeds in denying the users access to the device,” said Bogdan Botezatu of Bitdefender. By disabling the home and navigation keys, the Android ransomware restricts users to their home screen, which shows an FBI splash screen warning that they’ve broken the law by visiting adult websites and must pay a $500 fine using a valid MoneyPak voucher code. It gets worse: According to Bitterwallet, the malware also includes lewd screenshots it claims are from the user’s browser history.

Botezatu said the malware is extremely effective because it doesn’t require administrator permissions, making it easier to sneak by security apps. Even rebooting the device won’t work because the malware runs alongside any boot process, and attempting brute-force removal by entering invalid MoneyPak codes only ups the ransom to $1500. It’s no surprise that the U.S. is the hardest-hit area since Canadian and British users aren’t likely targets of the FBI just for looking at XXX content. But as noted by CSO Online, malicious actors have also created a similar version of this malware using Koler ransomware, which serves up a warning message and ransom demand from the Royal Canadian Mounted Police.

Payback Is an Option

Fortunately, there’s an alternative for users who don’t want to pay the fine or hand over their device to corporate IT for cleaning. It requires booting in Safe Mode. First, users need to press and hold the power button, then press and hold “power off.” This should offer a “reboot to safe mode” option, allowing users to open the application manager and remove the malware directly. Alternatively, it’s possible to connect the smartphone to a PC and remove the malware remotely so long as Android Debug Bridge is enabled on the mobile device.

Android ransomware is getting more sophisticated but continues to leverage the fear of shame or discovery to convince users they should pay up rather than risk embarrassment. While it’s possible to remove this malware after the fact with no harm done, it’s easier to avoid the problem altogether. G-, R- or XXX-rated content notwithstanding, opening unsolicited email attachments is always risqué.