Mantax Otax: The Android Malware That Encrypts, Spies On and Intimidates Its Victims

Zimperium, a company specializing in mobile security, has described a new strain of Android malware — Mantax Otax. It blends the capabilities of ransomware and spyware: it encrypts files, steals sensitive data, and also bombards the victim with spam and threats.

The malware is distributed by operators based in Indonesia — via malicious APK files hosted outside Google Play. To get a user to install the package, the attackers rely on phishing and social engineering techniques. Once installed, the app requests access to the Accessibility service, which gives it extensive control over the device.

The malware obtains the address of its command-and-control (C2) server from GitHub, after which it sends the operators details about the victim: location, mobile carrier, Android version and device identifier. Commands arrive via Firebase or WebSockets.

Encryption — Only on Older Versions

The ransomware module searches for files in external storage and encrypts them with an AES key unique to each victim. The originals are deleted, and the .enc extension is appended to the encrypted copies. Local images are replaced with ransom demands, and a full-screen Firebase-based chat opens over the screen — for negotiating payment.

Curiously, the encryption only works on Android 9 and earlier. Starting with Android 10, the Scoped Storage feature substantially restricts access to other apps' files, leaving the ransomware with nothing but its own application data directory. The Zimperium researchers also got lucky: because of a misconfigured Firebase server, the attackers' correspondence with their victims was left publicly accessible.

Surveillance and Psychological Pressure

The spyware side of Mantax Otax intercepts the lock-screen PIN, reads SMS messages and one-time passwords, and gathers call logs, contacts, browser history, the list of installed apps, Google account data and coordinates. By imitating user actions through Accessibility, the malware extracts WhatsApp profiles and messages, as well as Telegram conversations. Using the MediaProjection API, it takes screenshots, records video in MP4 and streams the screen in near real time via the Catbox file-sharing service, and it also snaps photos from the device's cameras.

The second version introduced a separate set of features for intimidation: intrusive dialog boxes, full-screen videos, instantly popping-up “scary” images, and speech-synthesized messages that the operator plays through the speaker. All of this is meant to ramp up the pressure and push the victim into paying the ransom.

Since Zimperium works with Google as part of the App Defense Alliance, devices with an up-to-date Play Protect already detect and block Mantax Otax. The standard advice remains the same: don't install APKs from third-party sources, don't grant Accessibility access to suspicious apps, and trust only verified publishers.

Source: Bleeping Computer