Google Play Early Access Abuse Surfaces Alongside Mantax Otax Ransomware and Gigabud Banking-App Cloning Campaigns

Bitdefender found thousands of deceptive casino, reward, and utility apps abusing Google Play's review-free Early Access program, while Zimperium/zLabs detailed the Mantax Otax Android ransomware-spyware targeting Indonesian users and Group-IB tied…

A cluster of Android threat disclosures published September 10-11, 2026 covers app-store abuse, ransomware-spyware, and banking fraud. Bitdefender Labs reports threat actors are abusing Google Play's Early Access program, which blocks public reviews and ratings, to distribute thousands of deceptive casino, reward, and utility apps, many promoted on TikTok and Facebook with AI celebrity deepfake ads; a GTA imitator, 'Vice Streets: Open World,' surpassed 1 million downloads before disappearing from the Play Store. Casino-style apps sidestep gambling licensing, geofencing, and age-verification requirements, and one flagged utility, a QR scanner, requested device-launcher rights, enabling hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization; its report coincides with disclosures on Android malware families Hagaseca, Mantax Otax, StreamRat, and GoldFactory's Gigabud banking trojan. Separately, Zimperium and zLabs detail Mantax Otax, a ransomware-spyware-harassment strain delivered via sideloaded APKs on third-party file-sharing services through phishing and social engineering, targeting Indonesian users and linked to Indonesian threat actors. It abuses Accessibility and device-administrator permissions to steal lock-screen PINs, SMS one-time codes, contacts (and location, per GBHackers), and WhatsApp/Telegram chats, captures screenshots and MP4 screen recordings via MediaProjection (uploads to Catbox), photographs victims via hidden camera previews, and AES-encrypts files with '.enc' extensions on Android 9 and older, with Android 10+ Scoped Storage limiting encryption reach but not surveillance. Ransom negotiation happens via an on-device Firebase chat, whose misconfiguration exposed attacker-victim conversations and victim data; the C2 at apimantax[.]otax[.]fun dynamically fetches its active domain from a GitHub repository, and a second version adds WebSocket communication, app blocking, jumpscare/full-screen overlays, and remote text-to-speech harassment. Google Play Protect already detects and blocks it on up-to-date devices via the App Defense Alliance. In parallel, Group-IB found that GoldFactory's Gigabud banking trojan, aimed at Indonesian Android banking customers, installs Vwork, a trojanized copy of the open-source Shelter app, to create a hidden Work Profile…

• Bitdefender identified thousands of deceptive Google Play Early Access apps; the program blocks public reviews and ratings, removing a key trust signal.
• GTA imitator 'Vice Streets: Open World' exceeded 1 million downloads before disappearing from the Play Store.
• Early Access apps were promoted via TikTok and Facebook ads using AI celebrity deepfake videos; promised payouts never arrive, and casino-style apps sidestep gambling licensing, geofencing, and age-verification requirements.
• A flagged QR scanner requested device-launcher rights, enabling hidden web views for ad-click fraud and potentially fake login screens or two-factor code capture.
• Bitdefender recommends Android Enterprise Work Profiles; Google Workspace admins can disable Early Access apps for their organization.
• Mantax Otax (Zimperium/zLabs) combines ransomware, spyware, and harassment, spread via sideloaded APKs on third-party file-sharing services through phishing lures, targeting Indonesian users and linked to Indonesian threat actors.
• Mantax Otax AES-encrypts files and adds '.enc' extensions on Android 9 and older, deleting originals; Android 10+ Scoped Storage limits encryption reach but not surveillance.
• It steals lock-screen PINs, SMS one-time codes, contacts (and location per GBHackers), and WhatsApp/Telegram chats via Accessibility abuse and a fake system-lock overlay; it captures screenshots and MP4 recordings via MediaProjection…