Mantax Otax Android ransomware - Firebase ransom negotiation chat channel

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•2

Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.