Reported by 9 outlets

Timeline

1. original reporting

   Mantax OTAX Combines Android Ransomware and Spyware for Double-Extortion Attacks

   cyberpress.org · 32d ago · September 11th, 2026

   Linked to Indonesian threat actors, the malware represents a serious double-extortion risk it steals sensitive data before encrypting files and demands payment through a built-in chat feature. The malware is distributed as a malicious Android APK hosted on third-party file-sharing services. Victims may be tricked into sideloading it through phishing messages, social-engineering lures, shared links, or messaging platforms. This delivery method helps operators bypass official app-store checks. After installation, Mantax OTAX requests device administrator access and a wide range of dangerous permissions. These include access to SMS messages, contacts, audio, images, and Accessibility services. If granted, the permissions give attackers extensive visibility and control over the infected device. The malware communicates with its command-and-control server over HTTPS. It retrieves its active C2 address from a GitHub repository, allowing operators to change infrastructure quickly if a domain is blocked. One observed C2 domain was apimantax[.]otax[.]fun . During device registration, Mantax OTAX sends the attacker a unique device ID, geographic location, network operator details, and Android version. It then receives commands through Firebase-backed infrastructure. Mantax OTAX Android Double-Extortion Mantax OTAX retrieves a unique encryption key from its C2 server and scans the device for valuable files. It targets documents, images, videos, archives, databases, and cryptographic key

2. update from osintsights.com

   MantaxOtax Malware Targets Android Devices with Ransomware and Spyware Meet MantaxOtax, a sneaky malware that's putting Android users on hig

   osintsights.com · 33d ago · September 10th, 2026

   MantaxOtax Malware Targets Android Devices with Ransomware and Spyware Meet MantaxOtax, a sneaky malware that's putting Android users on hig

   via Mastodon https://osintsights.com/mantaxotax-malware-targets-android-devices-with-ransomware-and-spyware?utm_source=mastodon&utm_medium=social

3. update from winfuture.de

   # Cybersecurity Researchers warn about Mantax Otax: The # Android malware spies on data and extorts victims. Protection offered by current OS versions

   winfuture.de · 32d ago · September 11th, 2026

   Cybersecurity Researchers warn about Mantax Otax: The # Android malware spies on data and extorts victims. Protection offered by current OS versions

   via Mastodon https://winfuture.de/news,161210.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

4. update from tugatech.com.pt

   Mantax Otax, a new Android malware combining ransomware and spyware capabilities

   tugatech.com.pt · 32d ago · September 11th, 2026

   Mantax Otax, a new Android malware, combines ransomware and spyware capabilities to encrypt files and steal sensitive data. via Mastodon https://tugatech.com.pt/t90815-mantax-otax-novo-malware-para-android-junta-ransomware-e-espionagem

5. update from gbhackers.com

   Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files

   gbhackers.com · 32d ago · September 11th, 2026

   Mantax OTAX is aggressive Android malware family combines ransomware, spyware, credential theft, and remote device-control features in a single infection chain. Linked to Indonesian threat actors, the campaign targets users through sideloaded APKs and turns compromised devices into tools for surveillance, financial fraud and real-time extortion. Unlike conventional Android ransomware that focuses primarily on locking […] The post Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

6. update from zimperium.com

   New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims Indicators extracted from public reporting. Source:

   zimperium.com · 32d ago · September 11th, 2026

   New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims Indicators extracted from public reporting.

7. update from meterpreter.org

   Mantax Otax Android malware fuses ransomware, spyware, and harassment, encrypting files while stealing OTPs, PINs, and chats. Here is how it

   meterpreter.org · 29d ago · September 14th, 2026

   Mantax Otax Android malware fuses ransomware, spyware, and harassment, encrypting files while stealing OTPs, PINs, and chats. Here is how it

   via Mastodon https://meterpreter.org/mantax-otax-android-ransomware/?utm_source=mastodon&utm_medium=jetpack_social

8. update from securityonline.info

   Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and ext

   securityonline.info · 26d ago · September 17th, 2026

   Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and ext

   via Mastodon https://securityonline.info/mantax-otax-android-malware-spyware/?utm_source=mastodon&utm_medium=jetpack_social