Mantax Otax Android malware encrypts files on older phones, steals messages and PINs, and harasses victims

Updated: 2026.09.10 1M ago 1 sources

Malware Ransomware Social Engineering & Phishing

A newly reported Android malware family called Mantax Otax can lock files, spy on victims, and pressure them to pay ransom. Zimperium says the malware is being distributed by Indonesian operators through phishing and malicious APKs installed outside Google Play. It abuses Android Accessibility permissions, pulls command-and-control details from GitHub, uses Firebase or WebSockets for commands, steals SMS, one-time passwords, WhatsApp and Telegram data, and encrypts files on Android 9 and older devices.

Why it matters: This is a combined mobile ransomware and spyware threat that can both steal sensitive data and extort victims, especially people sideloading apps outside Google Play. Users should avoid unofficial APKs, deny Accessibility access to untrusted apps, and make sure Play Protect is enabled and updated.

Sources

New Android malware encrypts files, steals data, and harasses victims

Bill Toulas 2026.09.10 100% relevant

This article appears to be the initial reporting of Mantax Otax as a distinct Android malware family and campaign, with technical details on its ransomware, spyware, and harassment functions.