Executive Summary  

Mantax Otax is an actively developed Android malware family first publicly documented in September 2026. It combines spyware, ransomware, and psychological-harassment capabilities into a single hybrid threat, primarily targeting individual Android users in Indonesia. Victims are typically infected through sideloaded APK files distributed via phishing pages, messaging platforms, forums, and third-party file-sharing services.  

The malware provides operators with extensive surveillance capabilities, including screen recording, screenshots, camera access, SMS and OTP interception, location tracking, and the ability to access WhatsApp and Telegram conversations through Android Accessibility features. On Android 9 and earlier, it can also encrypt accessible files using victim-specific AES keys and display ransom messages.  

A second version identified shortly after the initial release expands the malware's coercive capabilities with persistent screen-locking, application blocking, touch-input suppression, dialog spam, disorienting image overlays, and remote text-to-speech. The rapid evolution from V1 to V2 indicates an actively maintained operation with multiple mechanisms for maintaining control and pressure over compromised devices.  

Threat Profile  

Overview  

Mantax Otax was first documented in early-to-mid September 2026, with two distinct versions identified in quick succession: a baseline version (V1) and a follow-on version (V2) that expands the malware's harassment and remote-control feature set. The name "Mantax" (also referenced as "Otax") derives from strings embedded in the malware's own command-and-control domains and application branding. The operation shows no indication of being a rebrand of a previously known Android malware family; it appears to be a purpose-built, actively maintained tool rather than a leaked or commodity builder.  

Attribution to Indonesian threat actors is based on several converging indicators: Indonesian-language permission prompts and lock-screen overlays shown to victims, Indonesian-language artifacts recovered from a misconfigured backend server, and a victim base that skews toward Indonesian Android users based on recovered device telemetry. Domestic Indonesian outlets covering the malware have echoed this attribution and flagged it as a locally-relevant threat given the Indonesian-language social engineering used to obtain permissions.  

The group operates its own backend infrastructure rather than functioning as an affiliate-driven service; there is no observed partner-recruitment or affiliate-program element comparable to ransomware-as-a-service operations. Instead, the operators appear to run a single, centrally managed campaign with a live operator panel showing the number and status of infected devices under their control.  

Operational Characteristics  

Mantax Otax departs from typical mobile banking trojans or simple screen-lockers in that it does not rely on a single extortion lever. Its operational model layers three components:  

This design means the malware remains dangerous to a victim even when its ransomware module is neutered by newer Android security controls — the operators can still weaponize stolen credentials, banking OTPs, and intimate photos/screen recordings for extortion or fraud. The malware resolves its live C2 domain dynamically from a public code-hosting repository rather than hardcoding it, letting operators rotate infrastructure without shipping a new build. The newer version further migrated part of its C2 channel to WebSockets, suggesting continued investment in evading network-based detection and takedown.  

Victimology

Geographic and Demographic Targeting  

Based on language indicators in phishing lures, permission prompts, and recovered victim data, current targeting is concentrated on individual Android users in Indonesia. A leaked operator-panel screenshot confirmed the existence of an active pool of infected devices under the group's control, though the exact number was not disclosed in available reporting. The malware's distribution model — generic phishing links and sideloaded APKs pushed through file-sharing platforms and messaging apps — is not technically restricted to a single country, so expansion beyond Indonesia cannot be ruled out as the campaign matures, but no confirmed victims outside Indonesia have been reported to date.  

Platform and Device Targeting  

Targeting is defined less by industry vertical (as with enterprise ransomware) and more by device posture:  

This makes older or budget Android devices — disproportionately common in the malware's core Indonesian target market — significantly higher-risk than devices on current OS versions.  

Technical Analysis  

Distribution and Initial Access  

Victims are lured into manually installing a malicious APK obtained outside the Google Play ecosystem. Observed distribution channels include:  

Recovered sample filenames show the operators varying the APK's apparent identity between builds (generic, unrelated-sounding names as well as samples that mimic the branding of a legitimate, well-known AI chatbot app) — a masquerading technique intended to lower victim suspicion at the point of install.  

Once installed, the app requests device administrator rights first. The administrator consent screen itself discloses (to the victim, if read) a set of dangerous capabilities including the ability to erase all device data, change or lock the screen lock, and disable the camera — permissions the malware later abuses directly. It then walks the victim through a chain of additional permission requests: camera, SMS, contacts, audio, and images, followed by a request to display content over other apps. The final and most consequential step is a request for Accessibility Service and notification access, presented via an Indonesian-language prompt; once granted, this gives the operators the ability to read on-screen content and simulate taps and gestures on the victim's behalf.  

Command-and-Control Infrastructure, Defense Evasion, and Persistence  

Mantax Otax does not hardcode its C2 address. Instead, on first run it fetches the current active C2 domain from a public code-hosting repository, then registers the device with that server over HTTPS, transmitting a generated device identifier along with location, mobile carrier, and Android OS version. This resolver pattern lets the operators seamlessly migrate to new domains if a given C2 endpoint is taken down or blocked, without needing to push a new malware build.  

Observed C2 infrastructure spans several distinct hosting patterns: dedicated attacker-registered domains, cloud-hosted real-time database backends (used as a lightweight command channel and, due to misconfiguration, as an inadvertent source of intelligence for defenders), and directly-addressed IP-based servers on non-standard ports. The newer version of the malware shifted part of its live command channel to WebSocket connections, likely to improve command delivery reliability and complicate simple HTTP-based network detection.  

For persistence and evasion, the malware:  

Data Collection, Credential Theft, and Surveillance  

With Accessibility and notification access granted, Mantax Otax operates a broad collection engine:  

Ransomware Module and Extortion Mechanism  

On eligible (older) Android devices, the malware requests a victim-specific AES encryption key from the C2, keyed to the device's Android ID so that each victim's key is unique. It then recursively scans accessible shared storage, targeting a wide range of file types (media, documents, archives, databases, and cryptographic key files), encrypts them, deletes the originals, and renames the encrypted output with a .enc extension. To maximize the psychological impact, it also overwrites local image files with ransom-notice graphics so that even a casual glance at the photo gallery confronts the victim with the extortion message.  

Following encryption, the malware forces a persistent, full-screen, in-app chat interface onto the device, giving the operators a direct real-time negotiation channel with the victim — functionally a "customer support" experience for the ransom payment. This chat channel is brokered through the same cloud backend used for parts of the malware's C2 traffic.  

Version 2 Enhancements  

The follow-on version retains the full V1 capability set and adds a set of coercive remote-control commands clearly intended to increase payment pressure independent of the encryption module: