Mantax Otax Android malware is a newly identified strain that combines ransomware, spyware, remote control, and outright harassment into a single package, a combination that makes it considerably nastier than your average mobile threat. Indonesian operators are distributing it through malicious APKs hosted outside Google Play, using phishing and social engineering messages to reach victims.
Once installed, the malware requests Accessibility service permissions, which hand it sweeping control over a compromised device. From there, it retrieves its command-and-control (C2) domain from GitHub and phones home with victim details: location, carrier, Android version, and device ID. The C2 can then push commands back through Firebase or WebSockets.
How Mantax Otax Android malware encrypts and ransoms older devices
The ransomware component targets devices running Android 9 or older. According to mobile security company Zimperium, the malware searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server. Original files are deleted, and encrypted copies receive a .enc extension. Local images are replaced with ransom notices, and a full-screen Firebase-hosted chat window opens to handle ransom negotiations directly on the victim’s own screen.
Android 10 and later are largely protected from the encryption module thanks to the ‘Scoped Storage’ feature, which limits what external-files directories an app can reach. The ransomware module, as Zimperium notes, cannot meaningfully operate against more recent versions of the OS. Zimperium researchers also discovered that a misconfiguration in the Firebase C2 server had exposed the attackers’ chats with victims, a careless operational security failure that gave researchers visibility into the campaign.
Spyware, screen recording, and deliberate intimidation
Beyond encryption, the malware carries a substantial spyware toolkit. It can steal lock-screen PINs for persistent access, read SMS messages and one-time passwords, access call logs, contacts, browsing history, installed app lists, Google account information, and location data. WhatsApp profiles and messages, as well as Telegram chats, are extracted using simulated user interactions driven through Accessibility services, essentially the malware quietly tapping through menus on the victim’s behalf.
The malware also abuses Android’s MediaProjection API to capture screenshots, record MP4 video, and stream the victim’s screen in near real time via the Catbox file hosting service. The device’s own cameras can be commandeered to take photographs and upload them to the operators.
Version 2 of Mantax Otax added a harassment layer that reads less like a security tool and more like deliberate psychological pressure. Repeated dialogue boxes, full-screen videos, rapid “jumpscare” image overlays, and remotely triggered text-to-speech messages played through the device’s speakers are all in the toolkit. The intent, clearly, is to rattle victims into paying rather than waiting them out or seeking help.
Because Zimperium is a Google security partner through the App Defense Alliance (ADA), Mantax Otax is already detected and blocked by up-to-date Android devices running an active Firebase-adjacent Play Protect service. The standard advice applies, but is worth repeating: do not sideload APKs from outside Google Play, do not grant Accessibility permissions to apps you do not fully trust, and stick to reputable publishers. Older Android devices (anything running version 9 or below) are at the greatest risk from the encryption module and should be treated with particular caution until they can be updated or replaced.
