MantaxOtax Android Malware Combines Ransomware and Spyware in Targeted Campaign
A newly identified Android malware strain, MantaxOtax, merges file encryption ransomware with extensive surveillance capabilities, enabling attackers to steal sensitive data while locking victims out of their devices. Researchers at Zimperium’s zLabs detailed the threat in a September 9 report, linking it to Indonesian threat actors and tracing its distribution to third-party file-sharing services, suggesting sideloading as a primary infection vector.
Ransomware Tactics
Upon installation, MantaxOtax escalates privileges by requesting device administrator access, followed by permissions for SMS, contacts, media, and Android Accessibility granting near-total control over the device. The malware fetches its command-and-control (C2) domain from a GitHub repository, allowing operators to swiftly switch infrastructure if a domain is blocked.
- Android 9 and earlier: The malware recursively scans external storage, encrypting files with AES and replacing originals with .enc copies. Each victim’s encryption key is tied to their Android ID, ensuring unique keys per device.
- Android 10 and later: Scoped Storage limits encryption to the app’s directory, reducing impact. The malware also overwrites image files with ransom notes and displays an on-screen chat interface for negotiations, hosted via Firebase. A server misconfiguration briefly exposed some extortion dialogues.
- Locking mechanisms: A fake system lock process intercepts the lock screen PIN, while later versions introduced persistent screen locking, app blocking, and touch-disabling overlays to frustrate victims.
Spyware Capabilities
Beyond ransomware, MantaxOtax functions as a full-fledged spyware tool, harvesting:
- Device data: App inventories, hardware specs, location, browser history, and linked Google accounts.
- Communication logs: SMS (including OTPs), call logs, contacts, and WhatsApp/Telegram messages via Accessibility abuse.
- Media & credentials: Gallery content, silent camera photos, and screenshots/screen recordings via the MediaProjection API, with captures uploaded to Catbox and links sent to operators.
Targeting & Evolution
Zimperium’s analysis based on language indicators, victim files, and a leaked operator control panel points to Indonesian-focused targeting. A second version introduced WebSocket communications, persistent overlays, and psychological tactics like:
- Repeated alert dialogues
- Full-screen video overlays
- Rapid image popups (every 600ms)
- Text-to-speech (TTS) harassment, forcing the device to vocalize attacker messages.
MantaxOtax follows THost9, another recent Android trojan that cloned banking apps within isolated work profiles to evade detection. The malware’s dual ransomware-spyware approach highlights the growing sophistication of mobile threats, particularly in regions where sideloading remains prevalent.
Source: https://www.infosecurity-magazine.com/news/mantaxotax-android-malware/
GitHub TPRM report: https://www.rankiteo.com/company/github
Firebase TPRM report: https://www.rankiteo.com/company/firebase
"id": "gitfir1789051130",
"linkid": "github, firebase",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'location': 'Indonesia (primary targeting)',
'type': 'individual users'}],
'attack_vector': 'third-party file-sharing services (sideloading)',
'data_breach': {'data_encryption': 'AES (for ransomware)',
'data_exfiltration': True,
'file_types_exposed': ['images', 'documents', 'media files'],
'personally_identifiable_information': True,
'sensitivity_of_data': 'high (PII, credentials, OTPs, '
'communication logs)',
'type_of_data_compromised': ['SMS',
'call logs',
'contacts',
'messages (WhatsApp/Telegram)',
'browser history',
'Google account data',
'media files',
'screenshots/screen recordings',
'device metadata']},
'date_detected': '2023-09-09',
'date_publicly_disclosed': '2023-09-09',
'description': 'A newly identified Android malware strain, MantaxOtax, merges '
'file encryption ransomware with extensive surveillance '
'capabilities, enabling attackers to steal sensitive data '
'while locking victims out of their devices. The malware '
'targets Android devices, encrypting files and harvesting '
'communication logs, media, and credentials.',
'impact': {'data_compromised': ['SMS (including OTPs)',
'call logs',
'contacts',
'WhatsApp/Telegram messages',
'browser history',
'linked Google accounts',
'gallery content',
'screenshots/screen recordings',
'device hardware specs',
'location data'],
'identity_theft_risk': 'high (PII and credentials harvested)',
'operational_impact': ['device locking',
'app blocking',
'touch-disabling overlays',
'persistent screen locking'],
'systems_affected': ['Android devices (primarily Android 9 and '
'earlier, limited impact on Android 10+)']},
'initial_access_broker': {'backdoors_established': ['GitHub-hosted C2 domains',
'Firebase-based chat '
'interface'],
'entry_point': 'third-party file-sharing services '
'(sideloading)'},
'investigation_status': 'ongoing (research disclosed)',
'lessons_learned': 'The dual ransomware-spyware approach highlights the '
'growing sophistication of mobile threats, particularly in '
'regions where sideloading is prevalent. Android '
'Accessibility abuse and device administrator privileges '
'remain critical attack vectors.',
'motivation': ['financial gain (ransom)', 'data theft (espionage)'],
'post_incident_analysis': {'corrective_actions': ['Enhanced mobile threat '
'detection for Android '
'devices',
'User education on '
'sideloading risks',
'Stricter app permission '
'controls'],
'root_causes': ['Sideloading from untrusted '
'sources',
'Exploitation of Android '
'Accessibility and device '
'administrator privileges',
'Lack of awareness about mobile '
'malware risks']},
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransom_demanded': True,
'ransomware_strain': 'MantaxOtax'},
'recommendations': ['Avoid sideloading apps from third-party sources',
'Disable device administrator access for untrusted apps',
'Restrict Accessibility permissions to essential apps '
'only',
'Monitor for unusual Firebase or GitHub-based C2 '
'communications',
'Update devices to Android 10+ to mitigate Scoped Storage '
'limitations'],
'references': [{'date_accessed': '2023-09-09', 'source': 'Zimperium’s zLabs'}],
'response': {'third_party_assistance': 'Zimperium’s zLabs (research and '
'disclosure)'},
'threat_actor': 'Indonesian threat actors',
'title': 'MantaxOtax Android Malware Combines Ransomware and Spyware in '
'Targeted Campaign',
'type': ['ransomware', 'spyware'],
'vulnerability_exploited': ['Android Accessibility abuse',
'Scoped Storage limitations (Android 10+)',
'Device administrator access escalation']}