Mantax Otax malware combines ransomware and spyware to target older Android devices
A newly discovered Android malware strain named Mantax Otax is being distributed via malicious APKs outside Google Play, primarily targeting Indonesian users through phishing and social engineering. It gains extensive device control by abusing Accessibility services, then encrypts files on Android 9 and older while also stealing sensitive data like SMS, call logs, and lock-screen PINs. Researchers found a misconfigured Firebase server that exposed the attackers' ransom chat communications with victims.
The malware's operators rely on sideloaded APKs and social engineering to reach Indonesian users. Once installed, it abuses Accessibility services to gain deep control, then fetches its command server from GitHub before executing commands via Firebase or WebSockets.
Its encryption module is limited to Android 9 and older due to Scoped Storage restrictions in newer versions. Beyond encryption, it captures screens, records video, and takes photos, while version 2 adds harassment tactics like jumpscares and text-to-speech. Google Play Protect already blocks it.
This malware could disproportionately affect users of older Android devices in Indonesia who rely on sideloaded apps, as they face both data theft and file encryption. The harassment features may escalate psychological distress, potentially coercing payments. The exposure of attacker chats via a misconfigured server suggests operational lapses, but the combination of spyware and ransomware could still normalize increasingly aggressive mobile extortion tactics, impacting digital trust among vulnerable populations.