The Mantax Otax malware combines ransomware, spyware and remote-control capabilities. It can encrypt files, steal sensitive information and harass victims with disruptive content.
Operators in Indonesia spread the malicious software through APK files hosted outside Google Play. They then use phishing and social engineering messages to convince targets to install the apps.
After installation, Mantax Otax requests access to Android’s Accessibility service. This powerful permission gives the malware extensive control over the infected device.
Malware Connects to Remote Servers
Mantax Otax retrieves the address of its command-and-control server from GitHub. It then sends information about the infected device to its operators.
The collected details include the victim’s location, mobile carrier, Android version and device identifier. Furthermore, attackers can send remote commands through Firebase or WebSocket connections.
This setup allows the operators to change infrastructure and control compromised devices in real time. It also supports the malware’s ransomware, surveillance and harassment functions.
Mobile security company Zimperium linked the operation to Indonesian threat actors. Researchers say the group relies on malicious APK packages rather than Google Play distribution.
Older Android Devices Face File Encryption
The ransomware component mainly affects devices running Android 9 or earlier. It searches shared storage for targeted file types and encrypts them with a unique AES key.
Mantax Otax obtains this key from its command-and-control server. After creating the encrypted copies, the malware deletes the original files and adds the “.enc” extension.
It also replaces locally stored images with ransom notices. Additionally, the malware opens a full-screen chat hosted through Firebase, allowing attackers to negotiate payments with victims.
Zimperium researchers found a configuration mistake in the Firebase server. Consequently, they gained access to conversations between the operators and their victims.
Android 10 and later include Scoped Storage protections, which limit how apps can access shared files. Therefore, Mantax Otax can only encrypt content inside its own external-files directory on newer devices.
Spyware Steals Messages and Account Data
Although file encryption is limited on newer Android versions, the malware still includes extensive surveillance features.
Mantax Otax can steal lock-screen PINs by displaying deceptive overlays. This capability helps attackers maintain access to a device even when the owner attempts to secure it.
The malware can also read SMS messages and one-time passwords. In addition, it collects call logs, contacts, browsing history, installed app lists and location data.
Attackers may obtain information connected to the victim’s Google account as well. As a result, the infection can expose both personal communications and account recovery codes.
Mantax Otax malware also targets messaging platforms. It can extract WhatsApp profiles and messages, along with Telegram conversations.
To perform these actions, the malware uses Accessibility permissions to simulate taps and other interactions. This technique allows it to navigate apps as if the victim were controlling the device.
Attackers Can Watch Victims’ Screens
The malware abuses Android’s MediaProjection API to monitor activity on infected phones. It can take screenshots, record MP4 videos and stream the display in near real time.
Mantax Otax sends some captured screen content through the Catbox file-hosting service. Therefore, operators may observe private messages, account activity and other sensitive information displayed on the device.
The spyware can also activate the phone’s cameras and capture photographs. It then uploads those images to the attacker.
Together, these features give the operators powerful surveillance capabilities. They can monitor both activity on the screen and the physical environment around the device.
Harassment Features Pressure Victims to Pay
The second version of Mantax Otax added several functions designed to intimidate victims. These include repeated dialog boxes and full-screen videos that interrupt normal phone use.
The malware can also display rapid jumpscare images. Moreover, attackers can trigger text-to-speech messages that play through the infected device’s speakers.
Operators control these actions remotely. Consequently, they can repeatedly disturb victims while demanding a ransom payment.
These harassment tools separate Mantax Otax from conventional mobile ransomware. Instead of only encrypting data, the malware creates an ongoing campaign of pressure and intimidation.
Play Protect Blocks the Android Threat
Zimperium participates in Google’s App Defense Alliance. Because of this partnership, updated Android devices with Play Protect enabled can detect and block Mantax Otax.
Users should avoid downloading APK files from links sent through messages or social media. They should also install apps only from reputable publishers and trusted stores.
Accessibility permissions require particular caution. Users should reject requests from unfamiliar apps, especially when the requested access does not match the app’s stated purpose.
Anyone who installed a suspicious APK should disconnect the device from networks and remove the app. They should also change exposed passwords from a clean device and review important accounts for unauthorized activity.
Keeping Android and Play Protect updated provides further protection. While newer storage controls reduce the ransomware threat, the spyware functions still make Mantax Otax malware dangerous.
0 responses to “New Android Malware Encrypts Files, Steals Data and Harasses Victims”