The Mantax Otax malware targets Android devices, combining ransomware and spyware functionality. It primarily affects smartphones running Android 9 or older, as the Scoped Storage feature introduced in Android 10 restricts its encryption capabilities.
The malware is distributed via phishing and social engineering as APK files from third-party sources. Upon installation, it requests Accessibility Service permissions to gain control over the device and exfiltrate data, including location, carrier details, and device identifiers.
Mantax Otax encrypts files using a unique AES key retrieved from a command-and-control server. It replaces images with ransom notes and opens a full-screen chat via Firebase to demand payment. The malware also steals PIN codes, SMS, call logs, and messages from WhatsApp and Telegram.
The second version of the malware introduces psychological pressure tactics, including persistent pop-ups, jump-scare images, and text-to-speech messages played through the device speakers. It also uses the MediaProjection API to stream screen content in real time.
