New Android Malware Encrypts Files, Steals Data, and Harasses Victims

New Android Malware Strain: Mantax Otax 🚨

A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.

How It Works 🔍

After installation, the malware requests permission to use the Accessibility service, which gives it extensive control over compromised devices. It retrieves its command-and-control infrastructure (C2) domain from GitHub and sends back victim details such as location, carrier, Android version, and device ID. The C2 may send commands through Firebase or WebSockets for execution.

Ransomware Features 💰

According to mobile security company Zimperium, Mantax Otax encrypts devices running older Android versions. It searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server. The malware then deletes the original files and adds the ‘.enc’ extension to the encrypted copies. Additionally, it replaces local images with ransom notices and opens a full-screen Firebase-hosted chat to facilitate ransom payment negotiations.

Spyware and Harassment Functions 📱

Apart from ransomware, Mantax Otax includes spyware, remote control, and harassment features. The malware can steal lock-screen PINs to maintain persistent access, read SMS and one-time passwords, access call logs, contacts, browsing history, app lists, Google account information, and location. It can also extract WhatsApp profiles and messages, as well as Telegram chats, using simulated interactions via Accessibility services. Moreover, it abuses Android’s MediaProjection API to capture screenshots, record MP4 videos, and stream the victim’s screen in near real-time via the Catbox file hosting service.

Intimidation Tactics 😱

Version 2 of the malware added harassment functions such as repeated dialog boxes, full-screen videos, rapid “jumpscare” image overlays, and remotely controlled text-to-speech messages played through the device speakers. These additional features add an intimidation component to the attacks, acting as a pressure mechanism for the victim to pay the ransom.

Prevention Tips 🛡️

Because Zimperium is a Google security partner via the App Defense Alliance (ADA), Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service. Users are generally advised not to install APKs from outside Google Play, not to give questionable apps Accessibility permissions, and to only trust reputable publishers.

For more information, you can read the full article here.