New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
Zimperium uncovered Mantax Otax, an Android ransomware that encrypts files, records screens, steals OTPs, and secretly photographs victims.
Zimperium reported a new Android threat, Mantax Otax, that combines ransomware with surveillance: it encrypts files with AES and adds a .enc extension on Android 9 and older, while abusing MediaProjection for screenshots and MP4 screen recording and using hidden camera previews to photograph victims. The malware intercepts SMS one-time passwords, WhatsApp and Telegram data, and lock-screen PINs through Accessibility abuse and a fake system-lock overlay, and can negotiate ransoms via an on-screen chat. Malicious APKs are hosted on third-party file-sharing services, and researchers linked the activity to Indonesian threat actors, with C2 dynamically retrieved from a GitHub repository (apimantax[.]otax[.]fun). A second variant adds WebSocket communications, app blocking, full-screen overlays, and remote text-to-speech messages.
- Encrypts files with AES on Android 9 and older, deletes originals, and adds a .enc extension.
- Abuses MediaProjection for screenshots and video, uploading captures to Catbox.
- Intercepts SMS OTPs, WhatsApp and Telegram data via Accessibility and a fake lock overlay that captures the PIN.
- Linked to Indonesian threat actors; second version adds WebSocket C2 and disruptive overlays.
- ATT&CK
- T1566 PhishingT1486 Data Encrypted for ImpactT1113 Screen CaptureT1056.002 GUI Input CaptureT1567.002 Exfiltration to Cloud Storage
- Vendors
- Zimperium
- Products
- AndroidMediaProjection
- Organizations
- Zimperium
- Countries
- Indonesia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apimantax.otax.fun | bound traffic. Type Indicator Description C2 domain hxxps://apimantax[.]otax[.]fun Active command-and-control domain dynamically retrieved |
| url | https://apimantax.otax.fun | cted outbound traffic. Type Indicator Description C2 domain hxxps://apimantax[.]otax[.]fun Active command-and-control domain dynamically retrieved |
From the original article
3 min read at cybersecuritynews.com
A newly uncovered Android threat combines ransomware with spying, creating a trap for people who install apps from untrusted links. Called Mantax Otax, the malware can lock files, watch the screen, intercept verification codes and secretly use a phone’s cameras, making one infection both an extortion and privacy crisis. The campaign appears built around standalone […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.