MantaxOtax Android Malware Combines Ransomware With Spyware

MantaxOtax Android Malware Combines Ransomware With Spyware 🚨

MantaxOtax Android malware has combined file encryption with extensive surveillance, allowing attackers to steal messages, credentials, and device data while restricting access to infected phones. In a technical write-up published on September 9, Zimperium’s zLabs team linked the malware to Indonesian threat actors, noting that some samples appeared to have been distributed as a standalone Android package on a third-party file-sharing service, indicating a sideloading route.

After installation, MantaxOtax requested device administrator privileges, followed by access to SMS, contacts, audio, images, and finally Android Accessibility, granting it broad control over device interactions. The malware resolves its live command-and-control (C2) domain from a GitHub repository, enabling operators to switch to new infrastructure without changing code if a domain is blocked.

Ransomware Capabilities 💰

Regarding its mobile ransomware capabilities, on Android 9 and earlier, MantaxOtax recursively scanned shared external storage, encrypted user files with AES, purged the originals from disk, and left .enc copies. Each key is fetched from the C2 against the device’s Android ID, ensuring that no two victims share one. However, on Android 10 and later, Scoped Storage confined the scan to the app’s own external files directory, significantly reducing what could be encrypted. Zimperium reported that the malware also overwrote the victim’s own image files with ransom graphics to make the demand unmissable. An on-screen chat interface then opened for negotiation, with exchanges running through Firebase, although a server misconfiguration left some extortion dialogues exposed.

Spyware Functionality 🔍

The mobile spyware side collected app inventories, hardware details, location, browser history, notifications, contacts, call logs, and SMS messages, including one-time passwords (OTPs), plus gallery content and linked Google accounts. It also extracted WhatsApp profiles and messages through Accessibility, as well as Telegram credentials and chat histories. The malware abused Android’s MediaProjection API for screenshots, MP4 screen recording, and near-real-time streaming, staging captures on the Catbox file host and sending the links back to its operators. It could also take silent photos using either camera.

Zimperium indicated that language indicators and recovered victim files suggested Indonesian targeting, and that the misconfigured server also yielded a screenshot of what appeared to be the operators’ control panel. A second version transitioned to WebSocket communications and added persistent screen locking, application blocking, and a transparent overlay that swallows all touch input. Other variants are designed purely to wear the victim down, featuring repeating alert dialogues, full-screen video overlays, image popups spawning every 600 milliseconds, and text-to-speech (TTP) that makes the handset speak the attacker’s words aloud.

For more details, check out the full article: Read full article