Revoyem locks the screen rather than encrypting files: it is a 2013 police-themed Windows locker that covers the desktop with a fake law-enforcement warning in the victim's own language, accuses the user of viewing illegal material and demands a fine through MoneyPak or PaysafeCard. First seen in Germany and the UK, it spread to Europe, Canada and the US through malicious ads on adult sites that pushed visitors to the Styx exploit kit. Analysis also reported it disabling Task Manager, starting itself at each Windows logon and taking data from the browser. The warning is not from any police force, so do not pay; remove the malware with a security tool, then change passwords saved in the browser. The related file-encrypting strain DirtyDecrypt has its own page.
Sources: Threatpost, Help Net Security
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161