Mantax Otax, a newly uncovered Android malware family, illustrates why Android ransomware remains a pressing threat. The strain encrypts files, steals credentials and harasses victims, showing that legacy devices are still lucrative for attackers. Early analysis by Zimperium confirms that the ransomware component activates on Android 9 and older, while newer OS versions mitigate the encryption routine.

Immediate threat vector

The malware spreads through malicious APKs hosted outside Google Play. Phishing messages and social-engineering lures convince users to sideload the app, then request Accessibility service permission. This permission grants the malware the ability to simulate user interaction, read screen content and control other apps, a red flag many overlook.

Android ransomware impact

Once Accessibility rights are granted, the app contacts a command-and-control server whose address is fetched from a public GitHub repo. The server returns a victim-specific AES key and a list of target file extensions. The ransomware scans shared storage, encrypts files, deletes originals and appends a ".enc" suffix. A full-screen ransom note appears, and a Firebase-hosted chat window opens for real-time payment negotiation.

How the ransomware works

The encryption module only runs on Android 9 and earlier because Android 10 introduced Scoped Storage, which isolates app access to external files. This technical detail disproves the belief that newer Android versions have eliminated ransomware risk. Legacy devices, especially in emerging markets, continue to provide a massive attack surface.

Spyware and harassment layers

Beyond encryption, Mantax Otax bundles a full spyware suite. It can steal lock-screen PINs, read SMS and OTP codes, harvest call logs, contacts, browsing history, installed app lists, Google account details and precise location data. The malware also extracts WhatsApp profiles and Telegram chats by automating UI interactions via Accessibility. Using the MediaProjection API, it captures screenshots, records video and streams the screen to the attacker through the Catbox file-hosting service.

Version 2 adds a harassment component: repeated dialog boxes, full-screen videos, rapid "jumpscare" overlays and remotely triggered text-to-speech messages that blast through the device speaker. These tactics increase psychological pressure, boosting the likelihood of ransom payment.

Detection and mitigation

Zimperium, part of Google’s App Defense Alliance, has already flagged Mantax Otax in Play Protect on up-to-date devices. However, the malware’s success depends on users disabling Play Protect and sideloading apps. Recommended mitigations include:

  1. Never install APKs from unknown sources – use Google Play or reputable third-party stores that verify signatures.
  2. Reject Accessibility permission requests for apps that do not explicitly need them.
  3. Keep Android OS updated – devices on Android 10 or later are largely immune to the encryption component.
  4. Enable Play Protect and run regular scans with reputable anti-malware tools such as AdwCleaner.

Market and regulatory ripple effects

The rise of Mantax Otax has broader implications. Mobile carriers in Indonesia and neighboring regions may see a surge in support tickets and face regulatory scrutiny as consumer-protection agencies investigate ransomware complaints. The FTC’s alerts on mobile scams highlight the risk of sideloaded apps, but enforcement remains limited. From a crypto perspective, attackers typically demand payment in cryptocurrencies to obscure the money trail. Monitoring the market cap rankings could reveal anomalous inflows linked to ransomware payouts.

Trusted source

For technical details and indicators of compromise, see the original report on BleepingComputer: New Android malware encrypts files, steals data, and harasses victims.

What to watch next

Researchers expect rapid iteration. Potential developments include:

  • New variants that bypass Scoped Storage by targeting internal app data or exploiting root privileges.
  • Expansion of the harassment module into ransomware-as-a-service kits sold on underground forums.
  • Legislative proposals in Southeast Asia mandating stricter controls on sideloaded apps and mandatory OS update windows.
  • Increased use of AI-generated phishing lures that embed malicious APKs in seemingly legitimate app bundles.

Bottom line

Mantax Otax shatters the complacent narrative that Android ransomware is a thing of the past. Legacy devices, permissive Accessibility grants and the lure of cryptocurrency payments keep the threat alive. Users must treat any Accessibility request as a potential red flag, and enterprises should enforce strict mobile device management policies that block sideloaded apps outright. The battle for Android security is far from won, and the next wave may blend even more psychological terror with traditional data theft.

Explore more on this topic