A new Android threat called Mantax Otax merges ransomware and spyware into one dangerous package. Discovered in a recent report, it highlights how attackers are increasingly combining extortion, surveillance, and account takeovers in a single malware strain. The campaign mainly leverages APK files offered outside of official app stores, deposited on third-party file-sharing platforms.
Users are often targeted via unsolicited links, phishing messages, or chat apps. Once they install the APK, the malware immediately begins demanding elevated access: device administrator privileges, SMS, contacts, audio, and images permissions. It also requests Android’s Accessibility permission, which can be abused to monitor screen content and interact with the phone on behalf of the user.
From Encryption to Screenshots and Secret Photography
On devices running Android 9 or older, Mantax Otax searches external storage for images, videos, documents, and even cryptographic keys, encrypting them with AES, erasing the originals, and appending a “.enc” extension to the encrypted files. It replaces deleted media with ransom notices. On newer versions—Android 10 and beyond—system restrictions limit its reach to its own external file directory, but the espionage tools remain fully functional.
Among its surveillance features are live screen-capture via MediaProjection, uploading screenshot content to Catbox, recording screen video, and streaming display content almost in real time. Hidden previews allow access to both cameras for taking photos without any visible user interaction—the images then get compressed, stored, encoded, and sent to attackers.
OTP Theft, Credential Abuse, and Overlay Tricks
The malware gathers not only files and media, but also contacts, call logs, browser history, location, installed apps, and Google-account settings. It monitors SMS, including incoming one-time passwords (OTPs), and tracks messages from WhatsApp and Telegram. Using the Accessibility permissions, it automatically opens conversations to access data.
A fake lock screen overlay is used to trick users into entering their PINs, which are captured by the malware. The second iteration of Mantax Otax introduces new capabilities: WebSocket-based communication, blocking of apps, unseeable overlays to intercept touch input, full-screen video overlays, and even remote text-to-speech prompts to scare or confuse victims.
Prevention and Organizational Defenses
The clearest safeguards begin before malware execution: avoid installing APKs from untrusted sources, unsolicited links, or unfamiliar file hosts. Beware of apps demanding Accessibility, screen-capture, camera, or administrator privileges that exceed what their functionality requires.
Signs of compromise include unexpectedly activated Accessibility services, odd overlays on screen, new lock screens, or strange permission prompts. Users should isolate compromised devices—disconnect from the network—and seek expert help before entering sensitive data. Organizations managing fleets of phones should monitor for sideloaded apps, unusual permission activations, and suspicious outbound traffic.
Indicators for threat intelligence teams include the C2 domain “apimantax.otax.fun”, dynamically retrieved by the malware via a GitHub repository. Tracking of active phishing and ransomware threats should be updated within 24 hours of discovery to reduce risk.
This hybrid threat—named Mantax Otax—shows the malware landscape continuing to evolve, combining ransomware’s financial coercion with spyware’s invasiveness. Victims lose both access and privacy, and credential theft deepens the long-term exposure.
Analysis: Mantax Otax represents a chilling escalation. Combining encryption with surveillance and account takeover potential makes it far more harmful than traditional ransomware that simply locks files. The addition of OTP theft and fake overlays attacks the core of multi-factor security defenses. Users and enterprises alike need to reassess how much trust they place in permissions and app sources. Going forward, the focus must shift from detecting malicious code to monitoring permission misuse, overlay behavior, and unauthorized app installation—things that are harder to fake, but often overlooked.
