MantaxOtax Android malware has combined file encryption with extensive surveillance, letting attackers steal messages, credentials and device data while restricting access to infected phones.
In a technical write up published on September 9, Zimperium's zLabs team linked the malware to Indonesian threat actors and said some samples appeared to have been distributed as a standalone Android package on a third-party file-sharing service, pointing to a sideloading route.
The Mobile Ransomware Side
After installation, MantaxOtax requested device administrator privileges, then access to SMS, contacts, audio and images and finally Android Accessibility, which gave it broad control over device interactions.
The malware resolves its live command-and-control (C2) domain from a GitHub repository, which Zimperium said lets the operators move to new infrastructure without changing code if a domain is blocked.
On Android 9 and earlier, the mobile ransomware recursively scanned shared external storage, encrypted user files with AES, purged the originals from disk and left .enc copies. Each key is fetched from the C2 against the device's Android ID, so no two victims share one.
On Android 10 and later, Scoped Storage confined the scan to the app's own external files directory, sharply reducing what could be encrypted. Zimperium said the malware also overwrote the victim's own image files with ransom graphics to make the demand unmissable.
An on-screen chat interface then opened for negotiation. Zimperium said those exchanges ran through Firebase and that a server misconfiguration left some extortion dialogues exposed.
A separate routine masqueraded as a system lock process, restricting access while intercepting the lock screen PIN.
Read more on Android spyware: RedWing Android Spyware Sold as a Service on Telegram
MantaxOtax Adds Remote Monitoring and Device Control
The mobile spyware side collected app inventories, hardware details, location, browser history, notifications, contacts, call logs and SMS messages including one-time passwords (OTPs), plus gallery content and linked Google accounts. It also pulled WhatsApp profiles and messages through Accessibility, and Telegram credentials and chat histories.
The malware abused Android's MediaProjection API for screenshots, MP4 screen recording and near-real-time streaming, staging captures on the Catbox file host and sending the links back to its operators. It could also take silent photos on either camera.
Zimperium said language indicators and recovered victim files suggested Indonesian targeting, and that the misconfigured server also yielded a screenshot of what appeared to be the operators' control panel.
A second version moved to WebSocket communications and added persistent screen locking, application blocking and a transparent overlay that swallows all touch input.
Others are built purely to wear the victim down: repeating alert dialogues, full-screen video overlays, image popups spawning every 600 milliseconds, and text-to-speech (TTP) that makes the handset speak the attacker's words aloud.
MantaxOtax follows THost9, an Android trojan reported this week that cloned banking apps into an isolated work profile to break the link between a malware alert and the fraud that followed.