Table of Contents
Introduction
A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. Indonesian operators distribute the malware through malicious APKs hosted outside Google Play.
According to mobile security company Zimperium, the malware targets users with phishing and social engineering messages, then requests permission to use the Accessibility service, which gives it extensive control over compromised devices.
Mantax Otax combines ransomware, spyware, and harassment capabilities into a single malicious package — making it one of the most dangerous Android malware strains seen this year.
How Mantax Otax Spreads
The malware is distributed through malicious APKs hosted outside Google Play, Android's official app store.
Distribution methods:
- Phishing messages — social engineering tactics to trick users
- Social engineering — convincing users to install malicious apps
- Third-party app stores — APKs hosted outside Google Play
- Indonesian operators — attributed to operators based in Indonesia
After installation, the malware retrieves its command-and-control infrastructure (C2) domain from GitHub and sends back victim details such as location, carrier, Android version, and device ID.
Ransomware Capabilities
Mantax Otax encrypts devices running older Android versions:
- Searches shared storage and encrypts targeted file types
- Uses a victim-specific AES key obtained from the C2 server
- Deletes the original files
- Adds the '.enc' extension to the encrypted copies
- Replaces local images with ransom notices
- Opens a full-screen Firebase-hosted chat for ransom payment negotiations
Android version limitation:
- The ransomware module only runs against Android devices running version 9 or older
- Android 10 and later have Scoped Storage security and privacy features
- This limits encryption capability to the external-files directory
Zimperium researchers were able to exploit a misconfiguration in the Firebase C2 server, which exposed the attackers' chats with victims.
Spyware Capabilities
Apart from ransomware, Mantax Otax includes extensive spyware and remote control features:
- Lock-screen PIN theft — overlays that steal lock-screen PINs to maintain persistent access
- SMS and OTP theft — reads SMS and one-time passwords
- Call logs — accesses call history
- Contacts — steals contact information
- Browsing history — monitors web activity
- App lists — enumerates installed applications
- Google account information — steals account details
- Location — tracks device location
Messaging app data theft:
- Extracts WhatsApp profiles and messages using simulated interactions
- Extracts Telegram chats using Accessibility services
Screen capture and surveillance:
- Abuses Android's MediaProjection API to capture screenshots
- Records MP4 videos
- Streams the victim's screen in near real time via the Catbox file hosting service
- Captures photographs using the infected device's cameras
- Uploads captured media to the operator
The malware can capture photographs using the infected device's cameras and upload them to the operator.
Harassment Features
Version 2 of the malware added harassment functions designed to intimidate victims into paying the ransom:
- Repeated dialog boxes
- Full-screen videos
- Rapid "jumpscare" image overlays
- Remotely controlled text-to-speech messages played through the device speakers
These additional features add an intimidation component to the attacks, which act as a pressure mechanism for the victim to pay the ransom.
How Users Are Already Protected
Zimperium is a Google security partner via the App Defense Alliance (ADA), which means:
- Mantax Otax is already detected and blocked by up-to-date Android devices
- Google Play Protect service actively blocks the malware
- Users with up-to-date devices are protected
Because Zimperium is a Google security partner via the App Defense Alliance (ADA), Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service.
How to Protect Yourself
Follow these best practices to protect your Android device:
1. Only Install Apps from Google Play
- Never install APKs from outside Google Play
- Avoid third-party app stores and sideloading
- Stick to reputable publishers
2. Be Careful with Accessibility Permissions
- Never grant Accessibility permissions to questionable apps
- Review which apps have Accessibility access
- Revoke permissions from apps you don't recognize
3. Keep Your Device Updated
- Install Android updates as soon as they're available
- Update to Android 10 or later for Scoped Storage protection
- Enable Google Play Protect
4. Be Vigilant Against Phishing
- Be suspicious of messages asking you to install apps
- Verify sender identity before clicking links
- Don't install apps from unsolicited messages
5. Use Mobile Security Solutions
- Consider using reputable mobile security software
- Enable device encryption
- Regularly review installed apps
Following these best practices will help protect your Android device from Mantax Otax and similar malware.
Final Thoughts
Mantax Otax is a dangerous new Android malware that combines ransomware, spyware, and harassment capabilities into a single malicious package. While Google Play Protect already detects it, users must remain vigilant about app installation and permission grants.
Key takeaways:
- Mantax Otax — new Android malware combining ransomware + spyware + harassment
- Distribution — malicious APKs outside Google Play
- Ransomware — encrypts files on Android 9 and older
- Spyware — steals PINs, SMS, WhatsApp, Telegram, and more
- Harassment — jumpscares, TTS messages, and pop-ups
- Protection — Play Protect already detects it
- Best practice — only install apps from Google Play
If your organization needs assistance with mobile device security or threat protection, contact SystemLogicIT for expert guidance.