A new Android attack combines malware and ransomware in a cocktail of cybercrime | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

A new Android attack combines malware and ransomware in a cocktail of cybercrime

Unique malware variant spotted targeting Android users

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Zimperium uncovers Mantax Otax, Android malware merging infostealer, RAT, backdoor, and ransomware

Distributed via APKs on third‑party stores, social media, and phishing; older Android versions most at risk

Steals extensive data, enables remote monitoring, then encrypts files with AES and demands ransom

When threat actors target people’s devices, they usually infect it with one of many malware strains: an infostealer, a remote access trojan, a backdoor, or a ransomware encryptor.

Rarely do we see all of these functionalities merged into a single entity, and even rarer - to have it target Android mobile devices - yet, security researchers Zimperium discovered just that.

The security outfit published an in-depth report on Mantax Otax, a unique strain of malware circulating in the wild. It is apparently developed by an Indonesian threat actor, targeting victims in the country, but we don’t know exactly how many people are infected, or if this campaign is aimed primarily at business users, or individuals in general.

The malware is being distributed as a standalone APK, meaning it can be found on third-party app stores, Telegram channels, forums, and across social media. There are no traces of Mantax Otax on any of the official app repositories, including the Google Play Store, or Samsung’s Galaxy Store. Zimperium also speculates that it is likely being distributed via phishing emails.

Mantax Otax primarily targets users sporting older Android phones. Versions 9 and older are most at risk, since on these devices the attackers can make use of all of the malware’s features. Android 10 and newer models do get some protection:

Hundreds of Android banking and crypto apps hit by dangerous new Rokarolla malware

Android users targeted by new Wind Relay malware which can clone contactless cards in just 13 minutes

Deep Seek accidentally built a working ransomware strain

“Conversely, on modern devices running Android 10 and above, the malware’s efficacy is severely hindered by native OS defenses, specifically Scoped Storage restrictions,” the researchers explained. “Due to these sandboxing rules, the ransomware is constrained to scanning only the application's localized external files directory, which drastically mitigates the blast radius and reduces the volume of accessible user files.”

Newer devices, as well as users of Zimperium’s Mobile Threat Defense (MTD) and Runtime Application Protection (z Defend) are said to be protected on a software level.

Another important caveat is the permissions. As is usual on Android devices, most malware won’t work unless the user grants an extensive set of permissions beforehand. In this case, Mantax Otax first asks for admin privileges, after which it grants itself an extensive list of capabilities, from accessing SMS messages, to contacts, audio, and images.

It then requests accessibility permissions, fully taking over the compromised device.

Mantax Otax is said to be quite capable. It steals browser history, contacts, call logs, SMS messages, notifications, files, gallery media, Google account information, device specifications, location data, and application inventories. It can also pull Whats App information such as messages and profiles, and on Telegram it can also pull lock-screen PINs.

This Android banking trojan uses a fake VPN prompt to silence Google's defenses

Nord VPN warns of fake Ryanair, Emirates, Qatar Airways websites used to spread malware

This devious malware scans over 300 apps to build an AI profile telling hackers which victims to target

Infostealing features aside, it also serves as a remote monitoring tool, grabbing screenshots, recording the screen, or livestreaming it directly to the attackers. It can take photos using both the front and rear cameras, although Zimperium did not mention any microphone-recording capabilities.

Finally, once all of the data has been harvested, it encrypts user files with AES, deletes the originals, and appends a .enc extension. Victims are then shown a chat interface where they can communicate with the attackers directly and negotiate a ransom payment in exchange for getting their device back.

The tool seems to be in continuous development. Zimperium found two separate versions, one being an “evolution” of the other: “Notably, it has modified its network traffic behavior to utilize Web Sockets and introduced a set of new commands,” the researchers said.

There is a reason why ransomware operators prefer targeting businesses instead of individuals. Although the latter has not disappeared entirely from the victim list, businesses stand to lose a lot more from disrupted operations and, as such, are targeted more frequently. Unfortunately, we don’t know what kind of app Mantax Otax is spoofing, therefore it is difficult to assess who the targets are.

➡️ Read our full guide to the best antivirus

Best overall: Bitdefender Total Security
Best for families: Norton 360 with Life Lock
Best for mobile: Mc Afee Mobile Security

Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, Io T, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Google appears to have killed off the Pixel Tablet after just three years, and the move has left users concerned for the fate of ‘one of the most underrated products'

More ads are coming to Chat GPT as Amazon signs new Open AI deal

Bluetooth is absolutely awful on Windows 11 — Microsoft is finally pushing out updates to fix it, but I won't hold my breath

Exclusive: 'Jason seems quite deadpan and monotone' — Former GTA dev says he wants to see more personality from the GTA 6 protagonist, since Rockstar 'usually gives us characters who are funny and have their own flair'

Infrastructure as a weapon: Why the US action against Italy’s Autistici/Inventati puts global digital rights on notice

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards