Executive Summary
A new mobile threat identified as Mantax Otax has been discovered targeting Android users, primarily in Indonesia. Attributed to Indonesian operators, the malware represents a tactical shift by integrating traditional ransomware encryption with sophisticated spyware and psychological harassment features. It is distributed via malicious APKs through phishing and social engineering campaigns outside the Google Play Store.
Technically, the malware leverages Android Accessibility Services to gain full device control, exfiltrate sensitive data, and monitor user activity in real-time using the MediaProjection API. While its ransomware capability is most effective on Android 9 and older due to Scoped Storage restrictions, its spyware functions remain highly potent on newer versions. The malware uses a dynamic C2 resolution mechanism via GitHub and facilitates ransom negotiations through a Firebase-hosted chat interface.
This threat is particularly significant due to its 'double-extortion' nature and the addition of harassment features in its second version, including 'jumpscare' overlays and automated speaker messages. These tactics increase the psychological pressure on victims to pay ransoms while simultaneously harvesting credentials and private communications.