Android Malware “Mantax Otax” Encrypts Files, Steals Data, and Harasses Victims
What Happened — Researchers identified a new Android malware family, Mantax Otax, that blends ransomware, spyware, and harassment functions. The payload is delivered via malicious APKs hosted outside Google Play and installed after users click phishing or social‑engineering messages. Once on the device it requests the Accessibility service, pulls a C2 domain from GitHub, encrypts files on Android 9‑or‑older devices, exfiltrates personal data, and displays ransom‑negotiation dialogs and disruptive pop‑ups.
Why It Matters for Trust & Control Assurance
- The abuse of the Accessibility service shows a gap in device‑access permission controls, a core control objective that continuous‑monitoring programs must evidence.
- Encryption of user files on older Android versions illustrates the need for secure configuration baselines and timely patch management across the device fleet.
- The C2 traffic via GitHub, Firebase, and WebSockets highlights the importance of network‑traffic monitoring as audit‑ready evidence of anomalous outbound connections.
Who Is Affected — Consumers running Android 9 or earlier, enterprises with BYOD or unmanaged mobile devices, and any organization that relies on Android‑based applications for business processes.
Recommended Actions
- Deploy Mobile Device Management (MDM) to block installation of unknown APKs and restrict the Accessibility service to approved apps.
- Enforce enterprise‑approved app stores and enable Google Play Protect or equivalent vetting tools.
- Monitor DNS and TLS traffic for connections to known C2 hosts (GitHub, Firebase, WebSockets) and retain logs for audit purposes.
- Conduct user‑awareness training focused on phishing, malicious APKs, and the risks of granting high‑privilege permissions.
Source: BleepingComputer
Technical Notes
- Attack vector: Phishing‑driven malicious APKs; abuse of Android Accessibility service.
- Capabilities: File encryption (AES key per victim), data exfiltration (device ID, location, contacts, SMS, OTPs), screen capture via MediaProjection API, remote chat via Firebase, harassment dialogs.
- Targeted OS: Android 9 and older (Scoped Storage in Android 10+ mitigates encryption).
- C2 infrastructure: Domains hosted on GitHub, command delivery via Firebase or WebSockets.
Source: BleepingComputer