Most malware picks a lane. Mantax Otax didn’t get that memo. Security researchers at Zimperium have reported a newly discovered Android threat that combines ransomware and spyware into a single package, and it’s one of the more aggressive pieces of malware we’ve seen in a while.
Here’s how it works. Once the malware is installed, it asks for access to Android’s Accessibility service, which is a legitimate feature designed to help users with disabilities interact with their phones. Granting it that permission hands the malware deep control over your device. From there, it pulls its command-and-control domain from GitHub and immediately starts sending your personal data back to the attackers: your location, mobile carrier, Android version, and device ID. Commands can be pushed back through Firebase or WebSockets.
Then things get worse. Once it reaches your phone’s shared storage, it encrypts your files using victim-specific AES keys and replaces your local images with ransom notices. So instead of your photos, you get a message telling you to pay up. It can also pull messages from WhatsApp and Telegram, capture screenshots, record video, and even stream your screen in real time. And if that’s not enough, the researchers found it actively harasses victims to pressure them into paying. That’s not just malware. That’s malware with a harassment campaign built in.
This matters because most people think of ransomware as a PC problem. Seeing it show up on Android in this form, bundled with full spyware capabilities, is a signal that mobile threats are getting more sophisticated. Android has a massive global user base, and attackers know it.
The good news is the file encryption only works reliably on Android 9 and older. If you’re on a more recent version, that specific part of the attack loses most of its bite. But the spyware components don’t have the same limitation, so don’t get too comfortable.
The malware spreads through malicious APKs distributed outside of Google Play, which means sideloading is your biggest risk factor. To keep yourself protected:
- Keep your Android version up to date
- Don’t sideload APKs sent to you via email or messaging apps
- Avoid sites that offer “cracked” or “modded” APKs
- If you need to sideload, stick to trusted sources like APKMirror or F-Droid
- When possible, download apps from the Google Play Store only
Sideloading isn’t inherently evil, but it removes a critical layer of protection. Google Play isn’t perfect, but it has screening processes that random APK sites simply don’t. Mantax Otax is a good reminder that the convenience of grabbing an APK from a sketchy link is almost never worth the risk.