Mantax Otax Android Malware Steals Data, Harasses Users
A new Android malware strain called Mantax Otax is combining ransomware and spyware in a single package, encrypting files, stealing sensitive data, and actively harassing victims into paying up. Indonesian operators are behind its distribution, and they are primarily targeting users outside Google Play.Mantax Otax spreads through malicious APKs hosted off Android’s official app store, with attackers using phishing and social engineering messages to trick people into installing it. Once on a device, the malware requests extensive Accessibility service permissions, which hands it broad control over the phone.

From there, it pulls its command and control domain from GitHub and sends victim details back, including location, carrier, Android version, and device ID. The command server can then issue instructions through Firebase or WebSockets, controlling the infected device remotely.

Why Only Older Phones Get Encrypted

According to mobile security firm Zimperium, the ransomware component specifically targets devices running Android 9 or older. It encrypts files in shared storage using a victim-specific AES key pulled from the command server, deletes the originals, and replaces them with encrypted copies carrying a “.enc” extension. Local images get swapped for ransom notices, and a full-screen chat window opens through Firebase to negotiate payment.

Android 10 and later versions include a feature called Scoped Storage, which restricts what apps can encrypt to a narrow external-files directory. That single change limits Mantax Otax’s reach considerably on newer devices, even without any user intervention.

The Spyware Runs Quietly in the Background

While the ransomware grabs headlines, Mantax Otax’s spyware functions are arguably more dangerous because they work regardless of Android version. The malware can steal lock screen PINs, read SMS messages and one time passwords, and pull call logs, contacts, browsing history, and Google account information. It can even extract WhatsApp profiles and Telegram chats by simulating user taps and interactions.

Version 2 of the malware added harassment tactics on top of this, including repeated dialog boxes, full screen videos, rapid jumpscare image overlays, and remotely triggered text-to-speech messages. These features exist purely to intimidate victims into paying, adding psychological pressure on top of the technical compromise.

Basic Habits That Actually Stop This

Avoiding Mantax Otax comes down to a handful of habits that block most Android malware in general:

  • Skip sideloading entirely. Malicious APKs almost always live on third-party sites, not Google Play.
  • Treat Accessibility permission requests as a red flag. Very few legitimate apps need that level of device control.
  • Stick to developers with an established track record and visible reviews.
  • Keep Google Play Protect turned on and updated, since it scans for known threats in real time.

Zimperium is a Google security partner through the App Defense Alliance, which means Play Protect on up to date devices should already detect and block Mantax Otax. That partnership gives most users a meaningful layer of defense without having to do anything themselves.

Vigilance still matters though. Malware like ToxicPanda and Manic keep emerging with new attack vectors, and Play Protect’s detection only works once a threat has been identified and added to its database.

Hashlytics Take

The most telling detail here isn’t the malware itself, it’s that Scoped Storage alone neutralizes the ransomware half of this threat on any phone running Android 10 or newer. That’s not a security feature working as designed against a novel attack, that’s an old OS-level protection quietly doing its job years after it shipped.

The real exposure sits with users on outdated Android versions who also sideload apps, which is a narrower but very real audience, often in regions where older devices and informal app distribution are both common. Play Protect closes most of the gap for everyone else, but only after Zimperium already did the work of identifying the threat.

Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates

RELATED ARTICLESMORE FROM AUTHOR