Mantax Otax: New Android Malware Blends Ransomware and Spyware

What is Mantax Otax?

Mantax Otax is a recently discovered Android malware family that combines two dangerous capabilities. It encrypts files on the infected device like traditional ransomware, while simultaneously acting as a spyware that captures personal data and sends unwanted messages to contacts.

Ransomware component

The ransomware module generates a unique encryption key for each victim. It then encrypts documents, images, and videos stored on internal memory and external SD cards. After the encryption process, a ransom note appears, demanding payment in cryptocurrency to obtain the decryption key.

Spyware capabilities

Beyond encryption, Mantax Otax monitors user activity. It harvests contacts, call logs, SMS content and location data. The stolen information is transmitted to command and control servers located in multiple jurisdictions.

How the malware spreads

The threat leverages several infection vectors that are common on Android devices.

Third‑party app stores that do not enforce strict vetting.
Malicious advertising (malvertising) that redirects users to a fake download page.
Phishing messages that contain a disguised APK file.
Compromised legitimate apps that receive an update containing the malicious payload.

Once the user installs the APK and grants the requested permissions, the malware gains the ability to read and write files, access the network and monitor device sensors.

Impact on victims

File encryption

Victims report that personal photos, work documents and backup files become inaccessible within minutes of infection. The ransom note typically includes a deadline, after which the decryption key may be destroyed.

Data theft

Collected contacts and messages are often used for further phishing campaigns. Location data enables attackers to target victims with location‑specific scams. In some cases, the stolen credentials are sold on underground markets.

Spam and harassment

The spyware module can send SMS or instant messages to the victim’s contacts, pretending to be the device owner. These messages contain malicious links or demand money, creating a cascade of secondary infections.

Detection and removal

Detecting Mantax Otax requires a combination of manual inspection and security tools.

Check for unfamiliar apps with admin privileges in the device settings.
Review battery usage and data consumption for spikes that may indicate background exfiltration.
Run a scan with a reputable mobile security solution such as Kaspersky security blog recommendations.
If encryption has occurred, back up unaffected files, then perform a factory reset after removing the malicious app.
Change passwords for accounts accessed from the compromised device.

Prevention strategies for Android users

Download apps only from the official Google Play Store.
Enable Google Play Protect and keep it up to date.
Review app permissions before granting access; avoid apps that request unnecessary admin rights.
Keep the operating system and all apps patched with the latest security updates.
Back up important data to a secure cloud service or offline storage regularly.
Be cautious of unsolicited messages that contain attachments or links, even if they appear to come from known contacts.

Industry response and future outlook

Security agencies have issued alerts about the rise of hybrid Android threats. The US CERT advisory highlights the need for coordinated defense between manufacturers, app stores and end users. Europol’s cybercrime portal notes that ransomware attacks on mobile platforms are increasing in frequency, suggesting that attackers see a lucrative market in smartphones.

Researchers at MITRE have added new techniques to the ATT&CK framework for Android, providing analysts with a structured way to identify and mitigate such threats.

As Android continues to dominate the global smartphone market, the temptation for cybercriminals to develop sophisticated payloads like Mantax Otax grows. Ongoing collaboration between security firms, device manufacturers and regulatory bodies will be essential to stay ahead of these evolving threats.

Users who follow the preventive measures outlined above reduce their risk of infection and protect personal data from being held hostage.