MantaxOtax Android Malware Combines Ransomware and Spyware in Targeted Campaign A newly identified Android malware strain, MantaxOtax, merges file encryption ransomware with extensive surveillance capabilities, enabling attackers to steal sensitive data while locking victims out of their devices. Researchers at Zimperium’s zLabs detailed the threat in a September 9 report, linking it to Indonesian threat actors and tracing its distribution to third-party file-sharing services, suggesting sideloading as a primary infection vector. ### Ransomware Tactics Upon installation, MantaxOtax escalates privileges by requesting device administrator access, followed by permissions for SMS, contacts, media, and Android Accessibility granting near-total control over the device. The malware fetches its command-and-control (C2) domain from a GitHub repository, allowing operators to swiftly switch infrastructure if a domain is blocked. - Android 9 and earlier: The malware recursively scans external storage, encrypting files with AES and replacing originals with .enc copies. Each victim’s encryption key is tied to their Android ID, ensuring unique keys per device. - Android 10 and later: Scoped Storage limits encryption to the app’s directory, reducing impact. The malware also overwrites image files with ransom notes and displays an on-screen chat interface for negotiations, hosted via Firebase. A server misconfiguration briefly exposed some extortion dialogues. - Locking mechanisms: A fake system lock process intercepts the lock screen PIN, while later versions introduced persistent screen locking, app blocking, and touch-disabling overlays to frustrate victims. ### Spyware Capabilities Beyond ransomware, MantaxOtax functions as a full-fledged spyware tool, harvesting: - Device data: App inventories, hardware specs, location, browser history, and linked Google accounts. - Communication logs: SMS (including OTPs), call logs, contacts, and WhatsApp/Telegram messages via Accessibility abuse. - Media & credentials: Gallery content, silent camera photos, and screenshots/screen recordings via the MediaProjection API, with captures uploaded to Catbox and links sent to operators. ### Targeting & Evolution Zimperium’s analysis based on language indicators, victim files, and a leaked operator control panel points to Indonesian-focused targeting. A second version introduced WebSocket communications, persistent overlays, and psychological tactics like: - Repeated alert dialogues - Full-screen video overlays - Rapid image popups (every 600ms) - Text-to-speech (TTS) harassment, forcing the device to vocalize attacker messages. MantaxOtax follows THost9, another recent Android trojan that cloned banking apps within isolated work profiles to evade detection. The malware’s dual ransomware-spyware approach highlights the growing sophistication of mobile threats, particularly in regions where sideloading remains prevalent.