Researchers at Zimperium have identified a new ransomware strain for Android named Mantax Otax that encrypts victim files while simultaneously recording and transmitting the device screen in real time.
The malware is distributed outside official app stores through standalone APK files hosted on file-sharing services. Links are delivered via messaging applications and phishing messages that trick users into manually installing the package.
Once active, Mantax Otax encrypts files using AES and appends the .enc extension. Ransom negotiations take place directly on the device through an on-screen chat interface displayed to the victim.
The malware records the screen as MP4 video and streams the footage to the operator while the device is in use. It also captures screenshots and uploads them to the Catbox service, and activates the camera to photograph the surrounding environment without any user notification.
Mantax Otax abuses accessibility services to read displayed content, intercepts SMS messages, and captures authentication codes sent by applications and banks. It collects contacts, call logs, and browsing history, steals credentials from WhatsApp and Telegram, and shows a fake lock screen to harvest the device PIN.
The impact depends on the Android version. On Android 9 and earlier the malware can reach all external storage. Starting with Android 10, Scoped Storage restrictions limit encryption reach, although surveillance functions continue to operate.
Language clues and files found on victims indicate a campaign aimed at Indonesia. Security recommendations include installing applications only from trusted stores, denying unnecessary accessibility, administrator, SMS, and camera permissions, and treating unsolicited APK files received via messaging with suspicion.
