A New Breed of Android Malware Blends Extortion With Harassment
Researchers at Zimperium zLabs have discovered a new Android malware strain called Mantax Otax that fuses ransomware, spyware, and psychological harassment into a single infection chain. Rather than simply encrypting files and demanding payment, Mantax Otax first strips victims of their privacy and then pressures them into paying through coercive, in-app harassment tactics.
How It Spreads
Mantax Otax is distributed as a standalone Android application outside of Google Play, hosted on third-party file-sharing services. Indonesian-linked operators push the malware through phishing and social-engineering messages that persuade victims to sideload the APK — the campaign currently appears focused on victims in Indonesia.
Permissions and Access
Once installed, the app requests device-administrator privileges, followed by permissions for SMS, contacts, audio, and images. It ultimately seeks Android Accessibility Service access — a high-risk permission that lets malware observe and manipulate on-screen content, automate interaction with other apps, and harvest data as it's displayed to the user.
Data Theft Capabilities
With Accessibility access granted, Mantax Otax can:
- Steal the device's lock-screen PIN to maintain persistent access
- Read SMS messages and one-time passwords (OTPs)
- Harvest call logs, contacts, browsing history, installed app lists, Google account information, and location data
- Extract WhatsApp profile data and messages, and Telegram chats, by simulating user interactions through Accessibility services
Surveillance Features
The malware abuses Android's MediaProjection API to capture screenshots, record MP4 video, and stream the victim's screen in near real time to operators via the Catbox file-hosting service. It can also take photos using the device's cameras and upload them directly to the attackers.
Ransomware Mechanics
Mantax Otax requests a unique encryption key from its command-and-control (C2) server, keyed to the victim device's Android ID. On Android 9 and older, it recursively searches shared external storage for documents, images, videos, archives, databases, and cryptographic key material, encrypting matches with AES and deleting the originals in favor of files carrying a .enc extension. Notably, it deliberately skips the Android/data and Android/obb directories — likely to avoid destabilizing the device and drawing attention before extortion can begin.
Harassment and Coercion Tactics
What distinguishes Mantax Otax from typical mobile ransomware is its psychological pressure campaign. Using Accessibility Services, it automates app interactions, blocks access to apps, and displays coercive full-screen overlays: ransom notes, "jumpscare" pop-ups, and text-to-speech harassment messages. It replaces local images on the device with ransom-themed graphics reading "Your files have been encrypted. Pay to decrypt," and opens an on-device chat portal — backed by Firebase — that lets operators negotiate directly with victims.
Command-and-Control Infrastructure
Mantax Otax retrieves its C2 domain dynamically from GitHub, then reports victim details — location, mobile carrier, Android version, and device ID — back to the operators. Commands are subsequently relayed through Firebase or WebSockets. This dynamic-resolution design lets operators rotate infrastructure if a domain gets blocked, without needing to distribute a newly compiled APK to victims.
An Actively Evolving Threat
Zimperium has already identified Mantax Otax v2 in circulation, which adds WebSocket-based control for enhanced remote-operator capabilities, including touch-blocking overlays and live video streams intended to further pressure victims into paying.
Why This Matters
Mantax Otax represents a meaningful escalation in mobile threats: rather than a single-purpose ransomware or spyware tool, it's an integrated extortion platform that surveils, humiliates, and financially pressures victims simultaneously. The combination of credential theft, OTP interception, real-time screen streaming, and targeted psychological harassment gives operators far more leverage than file encryption alone — and its dynamic, GitHub/Firebase-based C2 infrastructure makes takedown considerably harder than blocking a single static domain.
Recommendations
For Android Users
- Never sideload APKs from third-party file-sharing sites, forums, or unsolicited links — install apps only from Google Play or another trusted, verified store
- Be skeptical of Accessibility Service prompts — legitimate apps rarely need this permission, and it is the single most abused capability in modern Android malware
- Scrutinize device-administrator requests during app installation; decline them for any app that isn't a known MDM or security tool
- Keep your device on a current Android version — the file-encryption component targets Android 9 and older specifically
- If you suspect infection, disconnect from Wi-Fi/mobile data, boot into safe mode, and remove the app before it can exfiltrate further data or stream your screen
For Organizations
- Enforce mobile device management (MDM) policies that restrict sideloading on corporate-enrolled devices
- Deploy mobile threat defense (MTD) tooling capable of detecting Accessibility Service abuse and MediaProjection misuse
- Educate users, particularly in regions where this campaign is active, on the risks of installing apps from outside official stores
- Monitor for anomalous OTP/SMS-forwarding behavior, which can indicate an infected device is being used to intercept authentication codes for account takeover
Source: BleepingComputer