New Android malware encrypts files, steals data, and harasses victims

A new Android malware named Mantax Otax, distributed by Indonesian operators via malicious APKs outside Google Play, combines ransomware and spyware capabilities. It encrypts files on devices running Android 9 or older, steals sensitive data including lock-screen PINs, SMS, call logs, WhatsApp and Telegram messages, and enables real-time screen streaming. The malware also harasses victims using full-screen overlays, jumpscare images, and text-to-speech messages to pressure ransom payments, while communicating with C2 infrastructure hosted on Firebase.

AI-extracted · verify before operational use