MantaxOtax Android Malware Combines Ransomware With Spyware
Zimperium analyzed MantaxOtax Android malware combining AES file encryption with extensive spying, linked to Indonesian actors and distributed via sideloading.
Zimperium's zLabs published a technical analysis of MantaxOtax, an Android malware family that combines ransomware-style file encryption with comprehensive spyware, linked to Indonesian threat actors and distributed via sideloaded APKs on a third-party file-sharing service. The malware requests device administrator, SMS, contacts, storage and Accessibility permissions, resolves its C2 domain dynamically from a GitHub repository, and encrypts files with AES using per-device keys derived from the Android ID on Android 9 and earlier. It steals WhatsApp messages, Telegram credentials, OTPs and other data, and uses MediaProjection for screenshots and screen recording staged on Catbox; a second variant adds WebSocket C2 with persistent screen locking and app blocking.
- Malware requests device admin, SMS, contacts and Accessibility permissions for broad device control.
- Encrypts files with AES using per-device keys; C2 domain is resolved from a GitHub repository.
- Extortion chats run through Firebase; a misconfiguration exposed dialogues and an operator control panel screenshot.
- Collects WhatsApp messages, Telegram credentials, OTPs, and streams the screen via MediaProjection to Catbox.
- Second variant adds WebSocket C2, persistent screen locking, app blocking and touch-blocking overlays.
Full article478 words · extracted from infosecurity-magazine.com · click to collapse
MantaxOtax Android malware has combined file encryption with extensive surveillance, letting attackers steal messages, credentials and device data while restricting access to infected phones.
In a technical write up published on September 9, Zimperium's zLabs team linked the malware to Indonesian threat actors and said some samples appeared to have been distributed as a standalone Android package on a third-party file-sharing service, pointing to a sideloading route.
The Mobile Ransomware Side
After installation, MantaxOtax requested device administrator privileges, then access to SMS, contacts, audio and images and finally Android Accessibility, which gave it broad control over device interactions.
The malware resolves its live command-and-control (C2) domain from a GitHub repository, which Zimperium said lets the operators move to new infrastructure without changing code if a domain is blocked.
On Android 9 and earlier, the mobile ransomware recursively scanned shared external storage, encrypted user files with AES, purged the originals from disk and left .enc copies. Each key is fetched from the C2 against the device's Android ID, so no two victims share one.
On Android 10 and later, Scoped Storage confined the scan to the app's own external files directory, sharply reducing what could be encrypted. Zimperium said the malware also overwrote the victim's own image files with ransom graphics to make the demand unmissable.
An on-screen chat interface then opened for negotiation. Zimperium said those exchanges ran through Firebase and that a server misconfiguration left some extortion dialogues exposed.
A separate routine masqueraded as a system lock process, restricting access while intercepting the lock screen PIN.
Read more on Android spyware: RedWing Android Spyware Sold as a Service on Telegram
MantaxOtax Adds Remote Monitoring and Device Control
The mobile spyware side collected app inventories, hardware details, location, browser history, notifications, contacts, call logs and SMS messages including one-time passwords (OTPs), plus gallery content and linked Google accounts. It also pulled WhatsApp profiles and messages through Accessibility, and Telegram credentials and chat histories.
The malware abused Android's MediaProjection API for screenshots, MP4 screen recording and near-real-time streaming, staging captures on the Catbox file host and sending the links back to its operators. It could also take silent photos on either camera.
Zimperium said language indicators and recovered victim files suggested Indonesian targeting, and that the misconfigured server also yielded a screenshot of what appeared to be the operators' control panel.
A second version moved to WebSocket communications and added persistent screen locking, application blocking and a transparent overlay that swallows all touch input.
Others are built purely to wear the victim down: repeating alert dialogues, full-screen video overlays, image popups spawning every 600 milliseconds, and text-to-speech (TTP) that makes the handset speak the attacker's words aloud.
MantaxOtax follows THost9, an Android trojan reported this week that cloned banking apps into an isolated work profile to break the link between a malware alert and the fraud that followed.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/mantaxotax-android-malware/