A new Android malware strain has fused file encryption with wide-ranging surveillance capabilities, allowing attackers to seize messages, login credentials and device information while locking victims out of their phones. MantaxOtax, as the threat is called, was detailed in a technical analysis published September 9 by Zimperium's zLabs team, which traced the malware to Indonesian threat actors and found evidence of distribution through a third-party file-sharing service. The report found that some samples appeared to have been sideloaded as standalone Android packages rather than delivered through official app stores.
After installation, the malware requests device administrator rights, then access to text messages, contacts, audio and photos, and finally Android Accessibility permissions that grant sweeping control over device interactions. On devices running Android 9 or earlier, the ransomware component recursively scans shared external storage, encrypts user files using AES, deletes the originals from disk and leaves behind .enc copies. Each encryption key is retrieved from the command-and-control server based on the device's Android ID, meaning no two victims receive the same key. On Android 10 and later, Scoped Storage restrictions confine the scan to the app's own external files directory, drastically limiting what can be encrypted. The malware also replaces the victim's image files with ransom graphics to ensure the demand is seen, then opens an on-screen chat interface for negotiation that runs through Firebase.
The report finds that the spyware component collects app inventories, hardware details, location data, browser history, notifications, contacts, call logs and SMS messages including one-time passwords, plus gallery content and linked Google accounts. It also extracts WhatsApp profiles and messages through Accessibility permissions, along with Telegram credentials and chat histories. According to Zimperium, the malware exploits Android's MediaProjection API to capture screenshots, record MP4 screen video and stream near-real-time footage, staging captures on the Catbox file host and sending links back to its operators. A server misconfiguration left some extortion conversations exposed and also revealed a screenshot of what appeared to be the operators' control panel.
The command-and-control architecture is designed for resilience: the malware retrieves its live domain address from a GitHub repository, which Zimperium said allows operators to shift to new infrastructure without modifying code if a domain is blocked. Language indicators and recovered victim files pointed to Indonesian targeting. A second version of the malware switched to WebSocket communications and added persistent screen locking, application blocking and a transparent overlay that intercepts all touch input. Other harassment features include repeating alert dialogues, full-screen video overlays, image popups spawning every 600 milliseconds, and text-to-speech functionality that forces the handset to speak the attacker's words aloud. A separate routine disguised as a system lock process restricts access while capturing the lock screen PIN.
The appearance of MantaxOtax follows another Android trojan reported this week, THost9, which cloned banking apps into an isolated work profile to sever the link between a malware alert and the fraud that followed. The combination of ransomware and surveillance in a single package represents a shift in mobile threat tactics, as attackers seek both immediate payment and long-term access to sensitive data. For organizations and users alike, the reliance on sideloaded apps and broad permission requests underscores the vulnerability of devices that stray from official distribution channels or grant excessive access without scrutiny. Enterprises that allow personal devices or rely on bring-your-own-device policies face compounded risk when malware of this sophistication reaches users who lack the expertise to recognize the warning signs. The balance between user autonomy and platform security will become harder to maintain as dual-purpose threats multiply and Android's fragmented ecosystem leaves millions of older devices exposed.