Mantax Otax: The Android Malware That Locks Your Files, Then Screams At You Until You Pay
Indonesian operators are pushing an unusual Android malware that combines file-locking ransomware with spyware, screen recording and jumpscare harassment tactics designed to bully victims into paying.
Key points
- Zimperium researchers identified a new Android malware family called Mantax Otax, run by Indonesian operators and spread through malicious app installers hosted outside the Google Play store.
- The malware locks personal files on older Android phones, steals messages and PINs, records the screen, and harasses victims with pop-ups, loud audio and full-screen scare images to pressure them into paying.
- File-locking only works on devices running Android 9 or older, because Scoped Storage, a privacy feature added in Android 10, blocks the technique.
- Zimperium found a misconfiguration in the attackers' Firebase chat server and could read live negotiations between the criminals and their victims.
- Google Play Protect already blocks Mantax Otax on up-to-date devices.
A new Android malware strain locks your files, spies on you, and then harasses you with pop-ups and scary noises until you pay. Mobile security firm Zimperium calls it Mantax Otax and says the operators appear to be based in Indonesia. The findings were detailed in a Zimperium writeup and first reported by BleepingComputer.
How does the malware get onto a phone?
Victims install it themselves, after being tricked. Operators send phishing messages that push people toward downloading an APK, the installer file for an Android app, from websites outside the official Google Play store.
Once installed, the app asks for permission to use Android's Accessibility service, a feature meant to help people with disabilities control their phones by voice or gesture. Hand that to the wrong app and you've given near-total control of the device away.
From there, the malware retrieves its command-and-control server address from GitHub, then contacts that server to receive instructions. It reports back the phone's location, carrier and device ID.
What does it actually do to the victim?
On older phones it encrypts files, scrambling the contents using a victim-specific AES key fetched from the server. Mantax Otax hunts through shared storage, scrambles what it finds, deletes the originals and renames the copies with a '.enc' extension. It then replaces the phone's images with ransom notes and opens a full-screen Firebase-hosted chat window for payment negotiations.
Encryption only works on Android 9 and earlier. Newer versions enforce Scoped Storage, which stops apps from touching files outside their own directory.
The spying works on any version. The malware can steal the lock-screen PIN through a fake overlay, read SMS messages including one-time bank codes, pull contacts and browsing history, copy WhatsApp and Telegram chats by silently tapping through the apps, and record the screen as video or stream it live to the attacker via the Catbox file-hosting service.
| Feature | What it does | Works on |
|---|---|---|
| File encryption | Locks personal files, demands ransom | Android 9 and older |
| PIN theft | Fake lock screen captures the code | All versions |
| Chat theft | Reads WhatsApp and Telegram messages | All versions |
| Screen recording | Records or live-streams the screen | All versions |
| Harassment mode | Jumpscare images, forced audio, pop-ups | Version 2 onward |
Why is the harassment part getting attention?
Because it's designed to break the victim down. Version 2 added repeated pop-up dialogs, full-screen videos, rapid jumpscare image overlays, and text-to-speech messages the attacker can fire through the phone's speaker from anywhere. Pay, or the phone keeps screaming at you.
Zimperium found the attackers had misconfigured their Firebase server, which exposed the criminals' conversations with victims directly. Zimperium's zLabs team has form here: our earlier story from 16 June found the same researchers cataloguing 137 remote commands inside the Rokarolla Android trojan, including PIN capture and clipboard hijacking. Mantax Otax is more theatrical, but the underlying access it demands is similar.
What makes this worth watching beyond Indonesia is the harassment layer. File-locking ransomware on mobile has struggled because victims can often restore from cloud backup. Adding an active intimidation channel, one the operator controls in real time, is a way around that. It's social engineering bolted onto malware.
Should ordinary Android users be worried?
Probably not, if you stick to basics. Because Zimperium is a Google security partner through the App Defense Alliance, Play Protect already detects and blocks Mantax Otax on phones that are up to date.
Avoid installing apps from links sent in messages. Accessibility permission should go only to apps you've deliberately chosen for that purpose. A phone on Android 9 or older is effectively end-of-life; keep it away from banking and private photos.
Anyone who suspects a bad APK is already installed should disconnect from wifi and mobile data, then factory-reset from recovery mode.
