Loading story…
Researchers identified Mantax Otax, an Android hybrid spyware and ransomware family attributed to Indonesian threat actors and apparently targeting Indonesian users. Distributed through sideloaded APKs, it seeks device-administrator, sensitive runtime, and Accessibility permissions to gain extensive control, steal personal and communications data, capture screenshots and camera images, and—on Android 9 and earlier—encrypt user files with AES before demanding payment through an attacker-controlled chat interface.
A newer Mantax Otax v2 variant uses WebSockets to support persistent screen and application blocking, touch interception, overlay and dialog spam, jumpscare effects, and remote text-to-speech harassment. Its ability to capture GUI input and inject or interfere with user input aligns with mobile ATT&CK techniques T1417.002 and T1516, increasing both the surveillance and coercive impact on compromised devices.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers detailed Mantax Otax's AES file encryption and .enc extension behavior, screen and covert-camera capture, OTP theft, messaging-data collection, and fake lock-screen PIN capture. The analysis identified apimantax[.]otax[.]fun as an active C2 domain retrieved dynamically through GitHub and described a second version using WebSockets and disruptive device-control features.
A report identified Mantax Otax as an Android threat attributed to Indonesian actors that combines surveillance, device control, file encryption, and extortion. The analyzed malware uses sideloaded APKs, retrieves C2 infrastructure through GitHub, and includes an evolved v2 variant using WebSockets and expanded device-locking and harassment functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcexakep.ru
Open sourcebleepingcomputer.com
Open sourceinfosecurity-magazine.com
Open sourcezimperium.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Android malware strain known as **DroidLock** has been identified by Zimperium researchers, targeting users—primarily in Spanish-speaking regions—through phishing websites and malicious apps that impersonate legitimate services. Once installed, DroidLock requests device administrator and accessibility permissions, enabling it to lock users out of their devices, change PINs or passwords, wipe data, and even erase the device entirely. The malware employs sophisticated overlay techniques to steal unlock patterns and app credentials, and can stream screen activity, access text messages, call logs, contacts, and audio recordings. Attackers can remotely control infected devices via VNC, turning smartphones into surveillance tools and hostile endpoints. DroidLock communicates with its command-and-control server using both HTTP and WebSocket protocols, supporting at least 15 different commands for real-time manipulation. The infection process typically involves a dropper app that tricks users into installing the actual payload, bypassing Android security restrictions. Victims are presented with a full-screen ransom overlay, pressuring them to contact the attackers and pay a ransom within 24 hours or risk permanent data destruction. While DroidLock does not encrypt files like traditional ransomware, it achieves similar extortion by threatening to destroy or deny access to user data, making it a significant threat to both personal and corporate Android devices.
Jun 29, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Criminals used **OmniRAT**, a commercially sold remote administration tool, to take full control of Android devices through social-engineering lures and sideloaded apps. In one observed campaign, victims received SMS messages referencing the **Stagefright** flaw and were tricked into installing an APK named `mms-einst8923.apk`; the app then displayed a fake MMS notice, unpacked the malware, requested broad permissions, and enabled persistent surveillance and remote control. Avast reported that infected phones could also propagate the campaign by sending SMS messages to trusted contacts, while stolen data was sent to a Russian `.ru` command-and-control domain. Researchers later linked **GhostCtrl** to OmniRAT as a variant or spinoff that significantly expanded the malware’s capabilities. Trend Micro said GhostCtrl was distributed through phishing links and masqueraded as legitimate Android apps, while adding obfuscation, shell-command execution, device rooting, ransomware-like screen locking, covert audio and video recording, SMS/MMS abuse, and encrypted data theft; it also reused infrastructure associated with the **RETADUP** worm campaign that hit Israeli hospitals. A separate GitHub repository listing for `RAT.Android.OmniRAT` containing a file named `OmniRAT_Cracked.0e19cf.rar` further indicated the malware family and its tooling were circulating beyond isolated campaigns.
Aug 15, 2026