MantaxOtax fuses Android ransomware with surveillance tools

A newly documented Android malware strain called MantaxOtax combines ransomware, spyware and remote-control functions, enabling attackers to encrypt files, steal sensitive communications and obstruct victims from using infected phones.

Mobile security researchers at Zimperium’s zLabs detailed the malware on September 9, saying analysed samples were linked through language indicators and recovered victim material to threat actors operating in Indonesia. Some samples were distributed as standalone Android application packages on third-party file-sharing services, suggesting victims were persuaded to sideload the malware outside official app stores. No distribution through Google Play was identified.

Once installed, MantaxOtax seeks device administrator privileges before requesting access to SMS messages, contacts, audio, images and Android’s Accessibility services. Those permissions give the malware wide access to data and user interactions, supporting both surveillance and device-control functions. After registering with its command-and-control infrastructure, the malware can transmit the victim’s location, mobile network operator and Android version, providing operators with basic telemetry about each compromised handset.

The ransomware component is most effective on devices running Android 9 or earlier. On those systems, MantaxOtax recursively scans shared external storage, identifies targeted file types and encrypts them with the Advanced Encryption Standard. The target list includes images, videos, documents, archives, databases and cryptographic key material. The code avoids Android/data and Android/obb directories, a measure researchers said reduces the risk of destabilising the operating system while leaving much of the user’s accessible data exposed.

Researchers said the malware obtains a separate encryption key from its command-and-control server using the infected handset’s Android ID, meaning keys differ between victims.

Original files are deleted after encryption and replaced with copies carrying the. enc extension. The malware can also overwrite local images with ransom graphics informing the victim that files have been encrypted and payment is required for restoration.

Android 10 and later versions provide substantially greater resistance to that part of the attack. Scoped Storage restrictions limit the malware largely to its own external files directory, sharply reducing the number of user files that can be reached and encrypted. The surveillance functions, however, are not dependent on the same storage access.

MantaxOtax can collect installed-application lists, hardware information, location data, browser histories, notifications, contacts, call logs and incoming SMS messages, including one-time passwords used for account authentication. It can also enumerate linked Google accounts and remove media from the device gallery.

Researchers found that the malware abuses Accessibility services to obtain WhatsApp profile information and messages. It can also access Telegram credentials and chat histories by simulating user interaction, opening conversations and extracting contact names and message content.

The malware further uses Android’s MediaProjection interface to take screenshots, make MP4 screen recordings and stream a victim’s display in near real time. Captured images can be uploaded to the Catbox file-hosting service, with generated links sent back to the operators. Zimperium also identified commands allowing attackers to activate either camera and take photographs without the user’s knowledge.

Its command-and-control design is intended to withstand disruption. The malware retrieves the active server domain from a GitHub repository, allowing operators to redirect infected devices to new infrastructure without modifying the malicious application. Communications use HTTPS, while one analysed version relied on Firebase to distribute commands.

After encryption, MantaxOtax can force an on-screen chat interface onto the device so attackers can communicate directly with victims over ransom demands. Zimperium said a Firebase server misconfiguration exposed some of those extortion conversations during its investigation. The same exposed infrastructure also provided researchers with material indicating how the operators managed infected devices, including an image described as an attacker control panel.

A separate locking routine imitates a legitimate system process and can capture the victim’s screen-unlock PIN. Researchers also identified a newer version using WebSockets and additional commands that strengthen control over compromised devices.