Malware

MantaxOtax

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

2 techniques

T1036MasqueradingEvidence1

A separate routine masqueraded as a system lock process, restricting access while intercepting the lock screen PIN.

T1070.004File DeletionEvidence1

[It] encrypted user files with AES, purged the originals from disk and left .enc copies.

Credential Access

1 technique

T1056Input CaptureEvidence2

“collecting ... SMS—including one-time passwords (OTPs)” and “WhatsApp profiles and messages (via Accessibility).”

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

On Android 9 and earlier, the mobile ransomware recursively scanned shared external storage.

T1217Browser Information DiscoveryEvidence1

“collecting ... browser history.”

Collection

2 techniques

T1005Data from Local SystemEvidence2

“collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs)” and “exfiltrates gallery content.”

T1056Input CaptureEvidence2

“collecting ... SMS—including one-time passwords (OTPs)” and “WhatsApp profiles and messages (via Accessibility).”

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

“A second iteration adopted WebSocket communications for more resilient C2 channels.”

T1102.001Dead Drop ResolverEvidence1

“It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code.”

T1102.002Bidirectional CommunicationEvidence1

The malware resolves its live command-and-control (C2) domain from a GitHub repository... An on-screen chat interface then opened for negotiation. Zimperium said those exchanges ran through Firebase.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence2

“streams near-real-time footage to attackers, storing media on the Catbox file host.”

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

“On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files.”

T1491DefacementEvidence1

The malware also overwrote the victim's own image files with ransom graphics to make the demand unmissable.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cysecurity newsNews

Sep 12, 2026

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign - CySecurity News - Latest Information Security and Hacking Incidents

Android dual-purpose ransomware and spyware distributed through sideloaded APKs. It requests extensive privileges, encrypts files on Android 9 and earlier, extorts victims through a Firebase chat interface, and collects and exfiltrates sensitive device, communications, account, location, screen-recording, camera, and gallery data. It also uses screen locks, overlays, app blocking, repeated pop-ups, and text-to-speech harassment to coerce victims.

infosecurity magazine newsNews

Sep 10, 2026

MantaxOtax Android Malware Combines Ransomware With Spyware - Infosecurity Magazine

Android malware combining ransomware and surveillance capabilities. It requests device-administrator, sensitive-data, and Accessibility permissions; encrypts files on Android 9 and earlier; deletes originals; displays ransom graphics; and supports extortion chat. It also collects device, account, communications, location, browser, notification, gallery, and credential data; captures screenshots and screen recordings; streams captures; takes silent photos; intercepts lock-screen PINs; and can lock or block applications and suppress touch input.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MantaxOtax

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

2 techniques

T1036MasqueradingEvidence1

A separate routine masqueraded as a system lock process, restricting access while intercepting the lock screen PIN.

T1070.004File DeletionEvidence1

[It] encrypted user files with AES, purged the originals from disk and left .enc copies.

Credential Access

1 technique

T1056Input CaptureEvidence2

“collecting ... SMS—including one-time passwords (OTPs)” and “WhatsApp profiles and messages (via Accessibility).”

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

On Android 9 and earlier, the mobile ransomware recursively scanned shared external storage.

T1217Browser Information DiscoveryEvidence1

“collecting ... browser history.”

Collection

2 techniques

T1005Data from Local SystemEvidence2

“collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs)” and “exfiltrates gallery content.”

T1056Input CaptureEvidence2

“collecting ... SMS—including one-time passwords (OTPs)” and “WhatsApp profiles and messages (via Accessibility).”

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

“A second iteration adopted WebSocket communications for more resilient C2 channels.”

T1102.001Dead Drop ResolverEvidence1

“It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code.”

T1102.002Bidirectional CommunicationEvidence1

The malware resolves its live command-and-control (C2) domain from a GitHub repository... An on-screen chat interface then opened for negotiation. Zimperium said those exchanges ran through Firebase.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence2

“streams near-real-time footage to attackers, storing media on the Catbox file host.”

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

“On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files.”

T1491DefacementEvidence1

The malware also overwrote the victim's own image files with ransom graphics to make the demand unmissable.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cysecurity newsNews

Sep 12, 2026

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign - CySecurity News - Latest Information Security and Hacking Incidents

infosecurity magazine newsNews

Sep 10, 2026

MantaxOtax Android Malware Combines Ransomware With Spyware - Infosecurity Magazine

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.