New Android malware encrypts files, steals data, and harasses victims
Zimperium details Mantax Otax, an Android malware combining ransomware, spyware, and harassment, spread via phishing APKs to Indonesian users.
Zimperium researchers report Mantax Otax is distributed through malicious APKs hosted outside Google Play via phishing and social engineering, then abuses Accessibility permissions for broad device control. It encrypts files with a C2-provided AES key on Android 9 and older, adds '.enc' extensions, and hosts ransom chats on Firebase; researchers exposed attacker chats via a Firebase misconfiguration. The malware steals lock-screen PINs, SMS one-time codes, contacts, WhatsApp and Telegram chats, and captures screens via MediaProjection, while version 2 adds jumpscare overlays and text-to-speech harassment. Google Play Protect already detects and blocks it on up-to-date devices via the App Defense Alliance.
- Distributed via malicious sideloaded APKs using phishing and social engineering, targeting Indonesian users.
- Encrypts files with AES on Android 9 or older; Scoped Storage limits ransomware on Android 10+.
- Steals lock-screen PINs, SMS one-time codes, contacts, WhatsApp and Telegram chats, and screen recordings.
- Version 2 adds harassment features: repeated dialogs, jumpscare overlays, and remote text-to-speech messages.
- Researchers exposed attacker-victim chats through a Firebase C2 misconfiguration; Play Protect blocks it.
- ATT&CK
- T1566.002 Spearphishing LinkT1486 Data Encrypted for ImpactT1056.001 KeyloggingT1113 Screen Capture
- Malware
- Mantax Otax
- Organizations
- App Defense Alliance
- Countries
- Indonesia
From the original article
2 min read at bleepingcomputer.com
A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.