Mantax Otax: One APK, Three Roles — Encryption, Espionage and Victim Harassment
Summary
Mantax Otax is Android malware developed by an Indonesian group targeting Indonesian users. A single APK plays three roles: encrypting files for ransom, comprehensive espionage (lock-screen PIN, SMS/OTP, WhatsApp, Telegram, camera, location), and harassing victims with endless dialogs, jumpscare images, spoken threats and touch blocking.
Zimperium tracked two versions. V1 uses HTTPS and Firebase; V2 moves to WebSocket with an expanded harassment command set. A Firebase misconfiguration on the attacker's side exposed the C2 panel and extortion chats with victims. Google Play Protect now detects the malware.
Priority actions:
Block APK installs from outside Google Play on corporate Android devices via MDM, and review apps holding Accessibility or Device Admin rights.
Stop treating SMS OTP as a safe factor on devices that may be infected; prefer passkeys or device-bound authenticator apps.
What Makes It Different
The "ransomware" label is misleading. According to Zimperium, encryption is only really effective on Android 9 and earlier, where the malware can recursively traverse shared external storage. From Android 10, Scoped Storage sharply limits which files an app can reach.
On most modern devices, then, Mantax Otax's real value lies in the other two roles: data theft and psychological pressure to make victims pay. The attacker does not need successful encryption if they can lock the screen, play spoken threats and hold the victim's private messages.
Infection Chain
APK distribution. Files are hosted on third-party file-sharing platforms, with links sent via phishing messages and messaging apps. The apps pose as legitimate ones; Zimperium cites "Grok" as an example.
Stepwise permission requests. Device Admin first, then SMS, contacts, audio and images, and finally Accessibility for near-total device control.
Dynamic C2 resolution. The C2 domain (
apimantax[.]otax[.]fun) is fetched from a GitHub repository, letting operators rotate infrastructure without shipping a new APK.Victim registration. The malware POSTs to
<C2>/registerwith location, carrier and Android version.Command reception. V1 receives commands via Firebase; V2 switches to WebSocket.
Module execution. Depending on C2 commands: encryption, data collection, or harassment features.
Ransomware Module
The malware starts by retrieving an AES key from C2, unique per victim. It then walks shared storage and encrypts media, documents, archives, databases and cryptographic key files, appending .enc.
The ransom note is terse: "Your files have been encrypted. Pay to decrypt". The notable part is the negotiation channel: an on-screen chat interface running over Firebase that lets operators talk to victims in real time.
Spyware and the Harassment Toolkit
Data collection. Through Accessibility and the granted permissions, Mantax Otax takes:
Lock-screen PIN, contacts, call logs, SMS (including OTPs)
WhatsApp and Telegram messages
Browser history, installed apps, Google account information, location
Notification contents
Covert photos from front and rear cameras Screen surveillance. The malware takes screenshots (JPEG) and records video (MP4) via the MediaProjection API. Images are compressed, Base64-encoded and uploaded to Catbox, a free file host, with the URL sent to C2. Operators can watch the victim's screen almost live.
Harassment (added in V2). V2 switches to WebSocket and adds commands aimed at the victim's psychology:
| Command | Behavior |
|---|---|
dialogSpam / dialogSpamStop |
Continuous alert dialogs |
videoOverlay |
Full-screen video masking activity underneath |
jumpscarestart |
Shock image every 600ms, 2.5 seconds each |
touchBlock |
Transparent overlay intercepting all touches |
TTS_SPEAK |
Spoken threats via text-to-speech, configurable language, rate and pitch |
blockapp |
Blocks specified apps from opening |
These come with a lock screen telling the victim to contact the "admin", pushing them into the negotiation channel.
When the Attacker Exposes Themselves
Zimperium found the group's Firebase backend misconfigured, exposing the C2 panel with the list of infected devices and extortion chats between operators and victims. Zimperium did not publish victim counts or specific ransom amounts.
Analysis
Free infrastructure, immature operations. GitHub for C2 resolution, Firebase for commands, Catbox for data. It is cheap and easy to set up, and hard to block by domain because every piece is a legitimate service. But the exposed Firebase shows a lack of operational experience. This is most likely a small, self-developed group rather than MaaS; Zimperium noted no sign of it being sold.
Ransomware is the shell, spyware is the core. On Android 10 and later, encryption barely matters. The real damage comes from PINs, OTPs, chat content and the screen stream. For an enterprise, a BYOD device infected with Mantax Otax is a leak channel for OTPs and work messages, not a ransomware incident.
Harassment is an extortion tactic. Jumpscares, spoken threats and touch blocking do not steal data. They are built to panic victims into paying fast. Combined with access to private messages, operators gain extra leverage: the threat of leaking sensitive content.
Domain-based detection has limits. apimantax[.]otax[.]fun can be blocked, but because the domain is pulled dynamically from GitHub, operators can swap it easily. Full hashes and package names are in Zimperium's IOC repository and suit MDM or Mobile Threat Defense ingestion, but behavioral detection (Accessibility + Device Admin requests, full-screen overlays, MediaProjection) will last longer.
Relevance to Vietnam
The sideloaded-APK model is familiar. Vietnamese users have repeatedly been targeted by APKs impersonating government apps, spread via Zalo, Facebook and SMS. Mantax Otax uses the same channels and lures.
SMS OTP is still common across many services, even as banks move to Smart OTP and biometrics. Malware that reads SMS and notifications defeats this layer.
Older Android devices remain significant, especially in low-cost and shared devices. This is exactly where the encryption module works.
BYOD and work chat on personal messaging apps put enterprise data on unmanaged devices.
Recommendations
Block sideloading on corporate devices via MDM, allowing installs only from Google Play or an internal store; enable Google Play Protect.
Review sensitive permissions: alert when an unknown app holds Accessibility, Device Admin, SMS and overlay rights together.
Raise the minimum Android version for devices accessing corporate resources to Android 10+ for Scoped Storage and security patches.
Reduce reliance on SMS OTP: move to passkeys, authenticator apps or device-bound Smart OTP for internal and customer systems.
Ingest IOCs and watch behavior: load hashes/packages from Zimperium's repo into MTD/MDM; monitor traffic to Catbox and Firebase from unknown apps on managed devices.
User response guidance: do not pay, do not engage with the "admin", disconnect from the network, boot into Safe Mode to revoke Device Admin and uninstall the app, change passwords and PINs from a clean device, and report to the security team.
References
Zimperium zLabs (Vishnu Pratapagiri) — Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration (09/09/2026): https://zimperium.com/blog/mantax-otax-indonesian-mobile-ransomware-with-spyware-integration
Zimperium — IOC repository: https://github.com/Zimperium/IOC/tree/master/2026-09-MantaxOtax/
BleepingComputer (Bill Toulas) — New Android malware encrypts files, steals data, and harasses victims (10/09/2026): https://www.bleepingcomputer.com/news/security/new-android-malware-encrypts-files-steals-data-and-harasses-victims/
CNN Indonesia — Temuan Malware Mantax Otax asal Indonesia, Bisa Intip Chat WhatsApp (14/09/2026): https://www.cnnindonesia.com/teknologi/20260914070117-185-1403517/temuan-malware-mantax-otax-asal-indonesia-bisa-intip-chat-whatsapp
