Mantax Otax Android malware - possible persistent C2 loop via generic Firebase infrastructure (low-confidence, correlate with confirmed apimantax.otax.fun contact)

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.