"Mantax Otax encrypts devices running older Android versions," according to mobile security company Zimperium.
Distribution by Indonesian operators through sideloaded APKs
Zimperium attributes the campaign to Indonesian operators who distribute Mantax Otax through malicious APKs hosted outside Google Play. The attackers use phishing and social engineering messages to get victims to install those APKs, bypassing the protections of Android’s official app store, the researchers report.
After installation, the malware requests Accessibility service permissions, a powerful entitlement that gives Mantax Otax extensive control over a compromised device. The sample then retrieves a command-and-control (C2) domain from a GitHub-hosted location, and reports back a set of device details — location, mobile carrier, Android version, and device ID — to its operators. Zimperium says the C2 can issue commands via Firebase or WebSockets for remote execution.
How Mantax Otax encrypts files (Android 9 and older)
According to Zimperium, Mantax Otax’s ransomware module targets devices running Android 9 or older. It searches shared storage for specific file types, encrypts copies using a victim-specific AES key obtained from the C2 server, deletes the originals, and appends a “.enc” extension to the encrypted files. The malware also replaces local images with ransom notices and opens a full-screen Firebase-hosted chat to negotiate payment.
Crucially, the ransomware component is limited by post-Android 9 protections: Zimperium notes that Android 10 and later introduced the Scoped Storage feature, which significantly restricts access to external files and confines the malware’s encryption capability largely to the external-files directory. That constraint prevents the same wide-scale encryption behavior on newer devices.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSpyware, remote control, and data exfiltration capabilities
Mantax Otax pairs data-theft functions with its encryption behavior. Zimperium documents that the malware can steal lock-screen PINs to preserve persistent access, read SMS messages and one-time passwords, and collect call logs, contacts, browsing history, installed-app lists, Google account information, and location.
The malware leverages Accessibility services to simulate user interactions and extract messaging content, including WhatsApp profiles and messages as well as Telegram chats. It also abuses Android’s MediaProjection API to capture screenshots, record MP4 videos, and stream the victim’s screen in near real time; Zimperium says those screen streams are sent via the Catbox file-hosting service. Mantax Otax can additionally take photos with device cameras and upload them to the operator-controlled infrastructure.
Harassment module: version 2 adds pressure tactics
Zimperium reports that version 2 of Mantax Otax added explicit harassment and intimidation features designed to pressure victims to pay. Those additions include repeated dialog boxes, full-screen videos, rapid “jumpscare” image overlays, and remotely controlled text-to-speech messages played through the device speakers. Together with the ransomware and data-exfiltration capabilities, these functions form a coordinated pressure mechanism.
Operational security mistakes by the attackers have already provided defenders with intelligence: Zimperium researchers were able to exploit a misconfiguration in the malware’s Firebase C2 server, exposing the attackers’ chats with victims. That exposure gives analysts direct visibility into at least some victim-operator interactions.
What this means for end users and security teams
- End users: Zimperium and the advisory noted simple, concrete precautions — do not install APKs from outside Google Play, do not grant questionable apps Accessibility permissions, and only trust reputable publishers.
- Security teams and mobile defenders: the campaign highlights that older Android devices remain vulnerable to on-device encryption and broad data extraction. Defenders should monitor for sideloaded APK distribution patterns, unusual requests for Accessibility rights, and suspicious use of MediaProjection and network connections to Firebase, WebSockets, GitHub-hosted domains, or file-hosting services such as Catbox.
Because Zimperium is a Google security partner via the App Defense Alliance (ADA), the company says Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service. That defensive benefit reinforces the researchers’ practical guidance: where possible, keep devices updated and use platform protections designed to limit the reach of malware.
Mantax Otax combines tried technical tricks — sideloading, Accessibility abuse, MediaProjection misuse, and remote command channels — with an escalating harassment playbook to raise pressure on victims. Zimperium’s discovery of the Firebase misconfiguration shows how operator mistakes can expose their playbook; whether the attackers will shift infrastructures or harden their configurations remains an open question. In the meantime, the clearest line of defense in these incidents is prevention: avoid sideloaded apps, scrutinize permission requests, and keep Android devices current.
