MANTAXOTAX is a Android malware family that combines file-encryption ransomware with extensive spyware capabilities. The operators appear to have Indonesian origins, with Zimperium’s zLabs linking samples to Indonesian threat actors. Some campaigns reportedly distributed MantaxOtax as a standalone Android package via third‑party file-sharing services, suggesting a sideloading delivery route.
After installation, the malware seeks device administrator rights and then requests broad access to SMS, contacts, audio and images, followed by Android Accessibility, enabling extensive control over device interactions. It resolves its live command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the code if a domain is blocked.
On Android 9 and earlier, it encrypts user files with AES, clears originals, and stores .enc copies, with keys fetched per device via the Android ID so different victims receive unique keys. On Android 10 and later, Scoped Storage restricts encryption to the app’s own external files directory, and the malware reportedly overwrites the victim’s images with ransom graphics to ensure the demand is visible. An on-screen chat interface for negotiation runs through Firebase, with a misconfigured server exposing some extortion dialogues.
MantaxOtax’s spyware component collects a broad set of data: app inventories, hardware details, location, browser history, notifications, contacts, call logs, SMS (including OTPs), gallery contents and linked Google accounts, plus WhatsApp and Telegram data accessed via Accessibility. It abuses the MediaProjection API to capture screenshots, record video (MP4) in near real time, stage captures on Catbox, and share links with operators; silent photos can be taken with the device camera.
A second version moves to WebSocket communications and adds persistent screen locking, application blocking and a transparent overlay that swallows touch input. Additional tricks include repeated alert dialogues, full-screen overlays, rapid image popups, and text-to-speech that vocalises attacker messages. Evidence and observations from Zimperium’s report indicate Indonesian targeting and a misconfigured server exposure, with a screenshot of the operators’ control panel also referenced.