--- url: "https://www.xcademia.com/news/mantax-otax-android-malware-combines-ransomware-spyware-and-remote-device-control" title: "Mantax Otax Android Malware Combines Ransomware, Spyware and Remote Device Control" description: "Zimperium uncovers Mantax Otax, Android malware combining ransomware, spyware, credential theft, surveillance and remote device control." publishedAt: "2026-09-12T07:04:46.999+00:00" updatedAt: "2026-09-13T01:03:29.200121+00:00" type: news category: cybersecurity source_name: Zimperium zLabs source_url: "https://zimperium.com/blog/mantax-otax-indonesian-mobile-ransomware-with-spyware-integration" tags: - "#AndroidSecurity" - "#MobileMalware" - "#Ransomware" - "#Spyware" - "#Cybersecurity" - "#MobileThreats" - "#Malware" - "#ThreatIntelligence" --- # Mantax Otax Android Malware Combines Ransomware, Spyware and Remote Device Control > Zimperium researchers have uncovered Mantax Otax, an Android malware strain linked to Indonesian threat actors that combines ransomware, spyware, credential theft and remote device control in a single campaign. Source: **Zimperium zLabs** · 12 September 2026 **A**ndroid malware is increasingly combining multiple attack capabilities rather than relying on a single malicious function. Zimperium's zLabs research team has identified a new example of this trend in Mantax Otax, a malware strain that combines ransomware with extensive spyware and device-control capabilities. Published on September 9, 2026, the research links the campaign to Indonesian threat actors based on language indicators and recovered victim files. Zimperium identified two versions of the malware, with the second version adding further remote-control and disruption capabilities. ## A hybrid Android threat Mantax Otax is notable because ransomware is only one part of its functionality. The malware can collect browser history, contacts, call logs, SMS messages, notifications, device information, location data and files. Zimperium also found capabilities for capturing screens, recording video, accessing cameras and harvesting information from messaging applications. At the same time, the ransomware component can encrypt files on certain older Android devices. After encryption, the malware presents victims with an interactive chat interface that allows attackers to communicate directly with the victim and demand payment. This creates a combined extortion model: attackers can potentially steal sensitive information before disrupting access to files and the device itself. ## Infection begins with a malicious APK Zimperium's analysis found samples distributed as standalone Android APK files hosted through a third-party file-sharing service. The researchers say this points to sideloading as an important infection route. Potential victims may be persuaded to install the application through shared links, messaging platforms, phishing messages or social-engineering campaigns. Once installed, Mantax Otax requests device administrator privileges and then seeks access to sensitive resources such as SMS messages, contacts, audio and images. It also requests Android Accessibility permissions, which can provide the malware with extensive control over device interactions. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789211474716-info1--69-.webp) ## C2 infrastructure can change dynamically The malware communicates with command-and-control infrastructure over HTTPS. Zimperium found that Mantax Otax can obtain its active C2 domain from a GitHub repository rather than relying entirely on a hard-coded server address. This gives the operators a mechanism for changing infrastructure without modifying the malware itself. After resolving the active C2 server, the malware creates a unique device identifier and sends registration information that includes geographic location, network operator and Android OS information. The malware then maintains a command loop through Firebase infrastructure. ## Ransomware targets older Android versions more effectively The ransomware component requests an encryption key from the C2 server. Zimperium says the request contains the device's Android ID, allowing a different key to be supplied for each victim. The malware then searches for targeted file types, including images, videos, documents, archives, databases and cryptographic keys. On devices running Android 9 or earlier, it can recursively traverse shared external storage while avoiding certain Android system directories. Files are encrypted using AES and replaced with encrypted versions carrying the `.enc` extension. The malware can also alter image files to display ransom messaging. Android 10 and later devices provide an important limitation. Zimperium says Scoped Storage restricts the ransomware's access to files, limiting its ability to affect user data compared with older Android versions. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789211824863-info3--69-.webp) ## Spyware capabilities extend well beyond file theft The surveillance functionality is one of the more significant aspects of Mantax Otax. Zimperium found that the malware can collect: - Device and hardware information - Installed application information - Location data - Browser history - Notifications - Contacts - Call history - SMS messages - One-time passwords received through SMS - Local files and media - Google account configuration information - WhatsApp account information and messages - Telegram credentials and chat histories The malware uses Android Accessibility services to interact with applications and extract information from communications platforms. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789211866330-info2--71-.webp) ## Remote screen monitoring and camera access Mantax Otax also provides attackers with surveillance capabilities through Android's MediaProjection API. According to Zimperium, the malware can capture screenshots, record the device screen as MP4 video and provide near-real-time screen streaming. Screenshots and recordings can be sent through third-party file hosting infrastructure, including Catbox. This capability increases the potential impact because information does not have to be stored locally to become visible to an attacker. Data displayed on the screen, including private communications or credentials, can potentially be observed while the victim is using the device. The malware can also access both front and rear cameras and capture photographs without requiring visible interaction from the user. ## Mantax Otax can lock and disrupt the device The malware does more than steal information and encrypt files. It can masquerade as a legitimate system lock process and intercept the user's lock-screen PIN. Zimperium also observed capabilities that can restrict access to applications and interfere with touch input through a transparent overlay. The second version introduces additional harassment-oriented functionality. Commands can generate repeated dialog boxes, display full-screen overlays, trigger visual "jumpscare" effects and use the Android text-to-speech engine to make the device speak attacker-controlled text. These functions appear designed not only to compromise information but also to make the device difficult and stressful for the victim to use. ## Mantax Otax v2 expands remote control Zimperium identified two versions of the malware. Mantax Otax v2 changes its network communication behaviour to use WebSockets and introduces additional commands. Among the observed capabilities are persistent screen blocking, application blocking and touch-input interception. The evolution from the first version to the second illustrates how the malware is being developed as an interactive remote-control platform rather than simply as a conventional file-encrypting ransomware application. ## A Firebase exposure revealed attacker activity Zimperium's researchers also identified a server misconfiguration that exposed portions of the Firebase infrastructure used by the malware. The exposure allowed researchers to recover extortion dialogues and information related to infected devices. Zimperium said recovered files and language indicators suggested a focus on Indonesian victims. The researchers also identified a screenshot appearing to show the attackers' mobile C2 panel and information about devices under their control. ## Why this matters for Android security The Mantax Otax campaign demonstrates how mobile malware can combine several traditionally distinct attack objectives. Instead of choosing between ransomware, spyware or remote-access functionality, a single malware family can combine data theft, credential collection, surveillance, device locking and extortion. For organisations, the development reinforces the importance of controlling Android application installation, monitoring unusual permission requests and maintaining visibility over mobile devices used for business activities. Users should also be cautious about installing APK files obtained through messaging services, unfamiliar websites or file-sharing links. The infection chain described by Zimperium relies on convincing victims to manually install malicious software outside trusted distribution channels. ## Zimperium's assessment Zimperium states that its Mobile Threat Defense and Runtime Application Protection customers are protected against the Mantax Otax campaign, and says its on-device dynamic detection engine detects the analysed samples. It also says its Web Content Filtering capability can block malicious websites and C2 traffic for applicable Mobile Threat Defense customers. Those are vendor-specific claims and should be understood in that context. ## The broader security takeaway The announcement highlights a broader industry shift toward mobile malware that combines surveillance, credential theft and disruption into a single operational framework. Mantax Otax is particularly notable because the ransomware component is only one layer of the attack. The malware's ability to monitor screens, capture communications, access cameras, collect credentials and remotely interfere with the device creates a much broader security and privacy risk than conventional file encryption alone. For enterprises, this could mean that mobile security monitoring needs to consider not only whether a device contains ransomware, but also whether malicious applications are abusing legitimate Android capabilities such as Accessibility services, MediaProjection and application overlays. The development also reinforces the importance of mobile application governance, user awareness and controls around APK sideloading. Additional details were not disclosed in the announcement regarding the total number of victims or the financial proceeds generated by the campaign. ## Original source https://zimperium.com/blog/mantax-otax-indonesian-mobile-ransomware-with-spyware-integration ## Tags `#AndroidSecurity` · `#MobileMalware` · `#Ransomware` · `#Spyware` · `#Cybersecurity` · `#MobileThreats` · `#Malware` · `#ThreatIntelligence` --- ## About this content This Markdown news article is the citation-grade twin of [Mantax Otax Android Malware Combines Ransomware, Spyware and Remote Device Control](https://www.xcademia.com/news/mantax-otax-android-malware-combines-ransomware-spyware-and-remote-device-control). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/mantax-otax-android-malware-combines-ransomware-spyware-and-remote-device-control - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt