New Android malware encrypts files, steals data, and harasses victims

A new strain of Android malware, identified as Mantax or Mantax Otax, is currently targeting mobile users with a hybrid approach to cybercrime. According to coverage from BleepingComputer and TechRadar, the attack functions as a cocktail of cybercrime by combining traditional ransomware capabilities with sophisticated spyware tools. The malware is capable of encrypting a victim's files to lock them out of their own data while simultaneously executing data theft operations. Reports indicate that the software can record device screens, steal one-time passwords (OTPs), and secretly take photographs of the victims to facilitate extortion and harassment. Multiple cybersecurity outlets are tracking the deployment of this threat. Infosecurity Magazine and Zimperium emphasize that the malware integrates spyware functionality directly into its ransomware framework.

Specifically, India Today reports that researchers have issued warnings regarding the malware's ability to spy on WhatsApp communications and steal sensitive OTPs. These findings highlight a shift toward multifaceted attacks where the goal is not just a financial payout for decryption, but the active theft of personal credentials and the use of surveillance for the purpose of harassing the affected individuals. Contextual data provided by Zimperium identifies this specific threat as Indonesian mobile ransomware. This geographic origin suggests a regional focus or a development hub within Indonesia. The significance of this trend lies in the integration of multiple attack vectors into a single package; by combining screen recording and photo capture with file encryption, the attackers can gather leverage over the victim beyond the mere loss of files. The use of OTP theft specifically indicates an attempt to bypass security measures on other accounts and financial services, increasing the total risk to the user.

Future developments to monitor include the methods of distribution and the specific targets of the harassment campaigns. While the current reports from CyberSecurityNews and HotHardware focus on the "dirty tricks" and surveillance capabilities, coverage does not yet specify the exact delivery mechanism or the total number of compromised devices. Stakeholders should watch for updates on whether the malware is evolving to target specific industries or if it remains a broad threat to the general Android user base. The continued ability of the software to secretly access the camera and screen remains a primary point of concern for security researchers.