Mantax Otax Android Malware Combines Ransomware, Spyware, and Harassment

Summary

Zimperium reports that Mantax Otax, distributed through malicious APKs and phishing, encrypts files on Android 9 and older, steals sensitive data, and harasses victims. Up-to-date Android devices with active Play Protect detect and block it.

Key points

Indonesian operators reportedly distribute Mantax Otax through malicious APKs outside Google Play and phishing or social engineering messages.
The malware requests Accessibility permissions and retrieves C2 instructions through GitHub, Firebase, or WebSockets.
On Android 9 and older, it encrypts selected files with a victim-specific AES key, deletes originals, and adds the .enc extension.
It can steal PINs, SMS and one-time passwords, chats, account details, location, screenshots, video, and photos.
Version 2 adds harassment features including repeated dialogs, full-screen videos, image overlays, and remotely controlled text-to-speech.
Zimperium researchers found a Firebase C2 misconfiguration that exposed attacker-victim chats.
The article says up-to-date Android devices with active Play Protect detect and block Mantax Otax; users are advised to avoid untrusted APKs and questionable Accessibility requests.

Article Details

Event Type: Android malware combining ransomware, spyware, remote control, and harassment capabilities
Impact: Mantax Otax encrypts files on devices running Android 9 or older, steals sensitive device and account data, and can capture or stream screen content. It also harasses victims with intrusive messages and media. Zimperium reports that up-to-date Android devices with active Play Protect detect and block the malware.

Malware

Mantax OtaxMantax Otax is a new Android threat that blends ransomware and spyware to encrypt files, steal sensitive information, and harass victims.

Vendors

GoogleIndonesian operators spread it through malicious APKs outside Google Play, while the malware abuses Accessibility permissions, Firebase, and other services to control devices and exfiltrate data.

Products

AndroidMantax Otax is a new Android threat that blends ransomware and spyware to encrypt files, steal sensitive information, and harass victims.Firebase Realtime DatabaseIndonesian operators spread it through malicious APKs outside Google Play, while the malware abuses Accessibility permissions, Firebase, and other services to control devices and exfiltrate data.Google PlayIndonesian operators spread it through malicious APKs outside Google Play, while the malware abuses Accessibility permissions, Firebase, and other services to control devices and exfiltrate data.Play ProtectBecause Zimperium is a Google security partner via the App Defense Alliance (ADA), Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service.