A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims.
Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.
After installation, the malware requests permission to use the Accessibility service, which gives it extensive control over compromised devices.
Next, it retrieves its command-and-control infrastructure (C2) domain from GitHub and sends back victim details such as location, carrier, Android version, and device ID. The C2 may send commands through Firebase or WebSockets for execution.
According to Zimperium, Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, Android’s official app store, using phishing and social engineering messages to target victims.
Encrypting older Androids
According to mobile security company Zimperium, Mantax Otax encrypts devices running older Android versions. It searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server.
The malware then deletes the original files and adds the ‘.enc’ extension to the encrypted copies.
Mantax Otax also replaces local images with ransom notices and opens a full-screen Firebase-hosted chat to facilitate ransom payment negotiations.
Source: Zimperium
Zimperium researchers were able to exploit a misconfiguration in the Firebase C2 server, which exposed the attackers’ chats with victims.
Source: Zimperium
Mantax Otax’s ransomware module only runs against Android devices running version 9 or older, as the ‘Scoped Storage’ security and privacy feature in Android 10 and later significantly restricts the encryption capability to the external-files directory.
Spying, spamming, and harassing
Apart from ransomware, Mantax Otax includes spyware, remote control, and harassment features.
The researchers note that the malware can steal lock-screen PINs to maintain persistent access, read SMS and one-time passwords, access call logs, contacts, browsing history, app lists, Google account information, and location.
Source: Zimperium
It can also extract WhatsApp profiles and messages, as well as Telegram chats, using simulated interactions via Accessibility services.
Additionally, it abuses Android’s MediaProjection API to capture screenshots, record MP4 videos, and stream the victim’s screen in near real time via the Catbox file hosting service.
Mantax Otax can also capture photographs using the infected device’s cameras and upload them to the operator.
Version 2 of the malware added harassment functions such as repeated dialog boxes, full-screen videos, rapid “jumpscare” image overlays, and remotely controlled text-to-speech messages played through the device speakers.
These additional features add an intimidation component to the attacks, which act as a pressure mechanism for the victim to pay the ransom.
Because Zimperium is a Google security partner via the App Defense Alliance (ADA), Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service.
Users are generally advised not to install APKs from outside Google Play, not to give questionable apps Accessibility permissions, and to only trust reputable publishers.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
