Mantax Otax Android malware mixes ransomware and spyware

Zimperium zLabs described Mantax Otax as a hybrid Android family that stacks a spyware suite, file encryption, and an on-device chat for ransom talks. The research post says language and recovered files point to Indonesian targeting.

Samples in the report arrive as standalone APKs on third-party file sharing. Infection is sideloading after phishing or social engineering, not a Play Store listing and not a zero-click worm. The writeup assigns no CVE and is not a CISA Known Exploited Vulnerabilities listing.

After install the malware asks for device admin, then SMS, contacts, audio, and images, then Accessibility. It pulls its command-and-control domain from a GitHub repo (the report's example is apimantax.otax.fun), then registers the device over HTTPS with geo, carrier, and Android version.

Encryption uses a victim-specific AES key from the C2. Originals are deleted and copies get a .enc extension. On Android 9 and earlier the scan walks shared external storage, skipping Android/data and Android/obb. On Android 10 and later, Scoped Storage largely confines that ransomware scan to the app's own external-files directory.

After encryption, a Firebase-hosted chat opens for negotiation. A misconfigured Firebase instance exposed attacker-victim dialogues to the researchers.

BleepingComputer and other secondaries reading a leaked panel screenshot have cited about 210 enrolled devices with two online at capture. That figure is a panel snapshot, not a census. Victim scale beyond that frame is not verified in the Zimperium writeup.

The spyware side steals lock-screen PINs through a fake system lock overlay, plus SMS and OTPs, call logs, contacts, browser history, and WhatsApp and Telegram via Accessibility. MediaProjection captures screenshots, MP4s, and a live stream staged through Catbox. Silent front and rear camera photos go out as well. Mantax v2 adds WebSockets, dialog spam, video overlays, jumpscare overlays about every 600 ms, remote text-to-speech through the speakers, and touch-blocking overlays.

BleepingComputer notes that Zimperium's App Defense Alliance partnership means Play Protect already detects samples on up-to-date devices with the service active. The research does not show a Google Play store compromise.

Some offers on this page may be paid placements or contain affiliate links.