BUCHAREST, Romania – Phony law enforcement notices popping up on Android-powered mobile phones are triggered by the latest porn-related malware bug, according to Romanian antivirus firm Bitdefender.

The Trojan, labeled Android-Trojan.Koler.A (Koler.A for short) is ransomware: Infected phones display a notice stating the user has downloaded illegal pornography and must pay a $300 fine in order to unlock the device.

Koler.A infects Android phones when a porn-seeking user downloads and installs a file masquerading as a “premium video player” from Badoink. Although the download bears the Badoink logo, the payload is a Trojan that disables the handset. Then the bug threatens the user with arrest unless he or she tenders a $300 “fine” via anonymous payment services like Paysafecard and uKash.

For maximum scariness, Koler.A uses a built-in geolocator to customize the arrest threat to whatever agency operates in the user’s locale. For instance, if the victim is in the U.S., the notice appears to come from the FBI, complete with an image of a stern Barack Obama pointing a finger directly at the viewer.

Big money is the reason ransomware blackmailers are moving into mobile. According to antivirus firm Symantec, ransomware extorts about $5 million annually from traditional PC users. The mobile market is the scammers’ next land of opportunity.

To get rid of Koler.A, “You can press Home and go to the homescreen, but a timer would bring [the legal threat screen] back on top in about five seconds,” Bitdefender Senior E-Threat Analyst Bogdan Botezatu told Ars Technica. “I managed to uninstall it manually by swiftly going to applications and dragging the icon on the Uninstall control, but it only works if the application icon is on the first row. Otherwise, one wouldn’t have the necessary time to drag it to the top, where the uninstall control is located.”

Malwarebtytes Unpacked offers removal instructions.