Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.
Researchers at zLabs and Zimperium analyzed Mantax OTAX, an aggressive Android malware strain distributed as sideloaded APKs through phishing and messaging lures on third-party file-sharing services. The malware requests device-administrator and Accessibility permissions to steal lock-screen PINs, intercept SMS one-time passwords, harvest contacts and history, capture screens via MediaProjection, and silently photograph victims, while encrypting files with AES and writing .enc files on Android 9 and older. Its C2 uses HTTPS at apimantax[.]otax[.]fun with the active domain fetched dynamically from a GitHub repository, and a newer version adds WebSocket communication, app blocking, video overlays, and text-to-speech harassment. A Firebase misconfiguration exposed extortion conversations and victim data, and Android 10+ Scoped Storage limits the encryption reach but not the surveillance capabilities.
- Steals lock-screen PINs, SMS OTPs, contacts, and location via Accessibility permissions.
- AES-encrypts files on Android 9 and older, replacing images with ransom graphics.
- Retrieves active C2 domain from GitHub; Firebase-backed on-device ransom chat exposed.
- Newer variant uses WebSockets, screen recording, jumpscare overlays, and TTS pressure.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1056.001 KeyloggingT1113 Screen CaptureT1486 Data Encrypted for Impact
- Vendors
- Zimperium
- Products
- Firebase
- Threat actors
- Indonesian threat actors
- Malware
- Mantax OTAX
- Countries
- Indonesia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apimantax.otax.fun | Mantax OTAX Android Ransomware Zimperium identified hxxps://apimantax[.]otax[.]fun as a C2-related domain in its analysis and published as |
| url | https://apimantax.otax.fun | lution. Mantax OTAX Android Ransomware Zimperium identified hxxps://apimantax[.]otax[.]fun as a C2-related domain in its analysis and published as |
From the original article
3 min read at gbhackers.com
Mantax OTAX is aggressive Android malware family combines ransomware, spyware, credential theft, and remote device-control features in a single infection chain. Linked to Indonesian threat actors, the campaign targets users through sideloaded APKs and turns compromised devices into tools for surveillance, financial fraud and real-time extortion.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.