Android users are being warned about a dangerous new malware that can turn a smartphone into a surveillance tool. Called Mantax Otax, the malware can reportedly watch a victim’s screen, steal SMS messages and OTPs, access WhatsApp and Telegram activity, secretly capture photos and encrypt files on older Android devices.
Security researchers at Zimperium discovered the malware and found that it combines spyware, ransomware and remote-control capabilities. Analysed samples were distributed as malicious APK files hosted on third-party file-sharing services, with attackers using phishing links, messaging platforms and social-engineering tactics to convince users to install them.
Malware Can Steal OTPs and Read WhatsApp
Once installed, Mantax Otax requests powerful permissions, including device administrator and Android Accessibility access. These permissions can allow the malware to interact with the phone and perform actions on behalf of the attacker.
The malware can reportedly collect SMS messages, including one-time passwords, along with contacts, call logs, browser history, location information, installed apps and other device data. It can also target WhatsApp profiles and messages and access Telegram activity.
The threat becomes even more serious through its screen-monitoring capabilities. Mantax Otax can abuse Android’s MediaProjection functionality to capture screenshots, record the screen and stream screen activity. Researchers also found that it can secretly use the phone’s front or rear camera to capture photographs.
Older Android Phones Face Ransomware Risk
Mantax Otax also includes a ransomware component. On Android 9 and older versions, researchers found that the malware can access shared storage and encrypt photos, videos, documents and other files using AES encryption.
Android 10 and newer devices have stronger storage restrictions that reduce the malware’s ability to encrypt files outside its application environment. However, newer Android devices can still remain vulnerable to the spyware and surveillance functions.
Malware Can Lock and Harass Victims
The newer version of Mantax Otax adds disruptive capabilities designed to intimidate victims. These reportedly include repeated pop-ups, full-screen videos, jumpscare-style images, screen blocking and remote text-to-speech messages.
Researchers have linked analysed samples to Indonesian threat actors, although the use of malicious APK distribution means the threat could potentially reach users in other regions as well.
How Android Users Can Stay Safe
Users should avoid installing APK files received through unknown websites, messaging platforms or unsolicited links. Unexpected requests for Accessibility or device administrator permissions should also be treated as a major warning sign.
Keeping Android devices updated and using Google Play Protect can provide additional protection. Mantax Otax highlights how mobile malware is evolving beyond traditional ransomware, combining OTP theft, private-chat surveillance, screen monitoring, camera access and file encryption in one attack.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram
