Malware

Mantax Otax

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.

Stealth

1 technique

T1070.004File DeletionEvidence1

The malware then deletes the original files and adds the '.enc' extension to the encrypted copies.

Credential Access

1 technique

T1056Input CaptureEvidence1

The malware can steal lock-screen PINs to maintain persistent access... Overlays that steal lock-screen PINs.

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

[The malware] sends back victim details such as location, carrier, Android version, and device ID.

T1083File and Directory DiscoveryEvidence1

It searches shared storage and encrypts targeted file types.

T1614.001System Language DiscoveryEvidence1

[The malware] sends back victim details such as location, carrier, Android version, and device ID.

Collection

4 techniques

T1005Data from Local SystemEvidence1

[The malware can] read SMS and one-time passwords, access call logs, contacts, browsing history, app lists, Google account information, and location.

T1056Input CaptureEvidence1

The malware can steal lock-screen PINs to maintain persistent access... Overlays that steal lock-screen PINs.

T1113Screen CaptureEvidence1

It abuses Android's MediaProjection API to capture screenshots, record MP4 videos, and stream the victim's screen in near real time.

T1125Video CaptureEvidence1

It abuses Android's MediaProjection API to capture screenshots, record MP4 videos... Mantax Otax can also capture photographs using the infected device's cameras.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The C2 may send commands through Firebase or WebSockets for execution.

T1102Web ServiceEvidence1

Next, it retrieves its command-and-control infrastructure (C2) domain from GitHub.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

[It can] stream the victim's screen in near real time via the Catbox file hosting service.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

It searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 day ago

uri●●●●●●●●●●●●View more in app1 day ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Sep 10, 2026

New Android malware encrypts files, steals data, and harasses victims

Android malware distributed through phishing/social-engineering lures and malicious APKs outside Google Play. It abuses Accessibility permissions for device control; retrieves C2 details from GitHub; and can receive commands through Firebase or WebSockets. Its ransomware module encrypts selected shared-storage files on Android 9 and earlier using a victim-specific AES key, deletes originals, appends .enc, displays ransom notes, and provides a Firebase-hosted chat for ransom negotiation. It also steals lock-screen PINs, SMS/OTPs, call logs, contacts, browser and application data, Google-account information, location, WhatsApp and Telegram data; records screens and video, takes screenshots and camera photos, and includes intimidation/harassment capabilities.

zimperium blogNews

Sep 9, 2026

Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

Android hybrid ransomware and spyware targeting Indonesian victims. It requests device-administrator and Accessibility privileges; steals PINs, SMS/OTPs, contacts, calls, browser history, files, messaging data, location, screenshots, screen recordings, and camera images. It encrypts accessible files using an AES key obtained from its C2, appends .enc, and replaces images with ransom notices. Its second version adds WebSocket C2, app blocking, touch-blocking overlays, dialog/video/jumpscare harassment, and remote text-to-speech.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Mantax Otax

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.

Stealth

1 technique

T1070.004File DeletionEvidence1

The malware then deletes the original files and adds the '.enc' extension to the encrypted copies.

Credential Access

1 technique

T1056Input CaptureEvidence1

The malware can steal lock-screen PINs to maintain persistent access... Overlays that steal lock-screen PINs.

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

[The malware] sends back victim details such as location, carrier, Android version, and device ID.

T1083File and Directory DiscoveryEvidence1

It searches shared storage and encrypts targeted file types.

T1614.001System Language DiscoveryEvidence1

[The malware] sends back victim details such as location, carrier, Android version, and device ID.

Collection

4 techniques

T1005Data from Local SystemEvidence1

[The malware can] read SMS and one-time passwords, access call logs, contacts, browsing history, app lists, Google account information, and location.

T1056Input CaptureEvidence1

The malware can steal lock-screen PINs to maintain persistent access... Overlays that steal lock-screen PINs.

T1113Screen CaptureEvidence1

It abuses Android's MediaProjection API to capture screenshots, record MP4 videos, and stream the victim's screen in near real time.

T1125Video CaptureEvidence1

It abuses Android's MediaProjection API to capture screenshots, record MP4 videos... Mantax Otax can also capture photographs using the infected device's cameras.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The C2 may send commands through Firebase or WebSockets for execution.

T1102Web ServiceEvidence1

Next, it retrieves its command-and-control infrastructure (C2) domain from GitHub.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

[It can] stream the victim's screen in near real time via the Catbox file hosting service.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

It searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 day ago

uri●●●●●●●●●●●●View more in app1 day ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Sep 10, 2026

New Android malware encrypts files, steals data, and harasses victims

zimperium blogNews

Sep 9, 2026

Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.