AndrewHumphreys Ok so, I am keeping Lock Glimpse enabled but the lock screen feature turned off. You can see from the screenshot that the the job remains active and it’s scheduled to be executed approximately every 18-24 hours (MINIMUM LATENCY):
Unfortunately, I don’t have root access on my device so I can’t force the job execution immediately. But I started PCAPdroid on my phone to monitor all the traffic for around 24h.
I will let you know if anything Lock Glimpse related pops up (Although I can’t seem to filter by the package “com.vilykke.lockscreen”, it’s not being found).
The worrying part is that from the decompiled APK we have the following:
I don’t see any check there for whether the feature is enabled or disabled.
Now, someone more technically knowledgeable than me and with root access to their phone could dive deep better into the decompiled APK code.
But as I mentioned in some previous posts, the codebase is filled with Google analytics methods. And the app is system-level privileged and cannot be entirely removed by users, which should be addressed.
[UPDATE 12/13/2025 00.06]
I just captured two requests going out to bloomrivers. This confirms that the app contacts external endpoints, exchanging data while it is enabled but the lock screen feature is off.
And this is a different endpoint from the one present in the codebase, because the URL builder is obfuscated.
By checking the endpoint website I find no reason as to why the app should contact it in the background. While the email for contact is highly suspicious:
—
@LockGlimpseUnEnjoyer Yesterday I deep dived into the source code of the decompiled APK and I found the API structure of the request bodies sent to bloom rivers. The API URL is obfuscated and dynamically built at run time. The request body contains the country, language, gaid1 (tracking across apps), gaid (persistent tracking ID), etc. And as a response body I received an actual AD, with my set language and also beamers that track when you SEE and CLICK the article. Now, this is visible only when you have “Display on Lock Screen” for Lock Glimpse. But by comparing the size of the responses both captured by PCAPdroid and coming from the mock request, they are very similar: around 27KB, so definitely not a simple ping.
