Executive Summary
A new Android malware strain dubbed Mantax Otax has been identified, primarily operated by Indonesian threat actors. This malware represents a dangerous evolution in mobile threats by integrating traditional ransomware functions with comprehensive spyware modules. It targets older Android devices (version 9 and below) for file encryption while maintaining a suite of intrusive surveillance features applicable to all versions, including real-time screen monitoring and data exfiltration.
The attack typically begins with social engineering or phishing messages directing users to download malicious APKs from third-party file-sharing services. Once installed, the malware aggressively requests Accessibility service permissions to gain total control over the device. It utilizes a dynamic C2 resolution mechanism via GitHub to ensure operational resilience and employs Firebase for interactive ransom negotiations.
Beyond data loss, Mantax Otax introduces a psychological harassment component in its second version. This includes 'jumpscare' overlays, automated dialogue spamming, and the remote execution of Text-to-Speech threats through the device's speakers. This multi-faceted approach significantly increases the pressure on victims to comply with ransom demands, posing a high risk to both consumer and enterprise mobile environments.