Most Android malware has a specific job. Ransomware demands payment for blocked files. Remote access trojans give hackers control of a device, while infostealers focus on stealing information, and backdoors provide ongoing access. The choice usually comes down to what the attacker wants to accomplish.

Mantax Otax takes a different approach. This malware strain, uncovered by researchers at Zimperium, targets Android devices and stuffs several dangerous tools into one package.

One App, Four Kinds of Trouble

Researchers have traced Mantax Otax to operators in Indonesia. It spreads through APK files hosted outside the Google Play Store, usually pushed on victims through phishing messages and social engineering. Once someone installs it, the app asks for accessibility permissions. The malware can then gain extensive control over the device.  

Once connected, the malware can do far more than collect basic device information. Its capabilities range from stealing information and monitoring activity to controlling the device and encrypting files. It does this by connecting to a command-and-control server to send basic details about the Android device, then waiting for instructions. Those instructions can trigger file encryption, data theft, screen recording, or camera access, all without the user noticing.

A later version of the malware adds more harassment features like jarring pop-ups, fake videos, and voice messages meant to pressure victims into paying up.

Older Android Devices Face the Biggest Risk

Google's Scoped Storage feature, introduced in Android 10, limits how much of the file system an app can reach. This effectively restricts the malware's ability to access and modify files enough to perform its ransomware function. As a result, researchers found that its ransomware capabilities appear to be limited to Android 9 and earlier.

Older phones, including budget models and unupdated company-issued devices, face the greatest risk of having files locked and renamed with a strange new extension.

Newer Android devices aren't necessarily safe, though. Even when the ransomware module can't fully operate, the spyware functions still work. Mantax Otax can steal lock-screen PINs, text messages, one-time passcodes, contact lists, browsing history, and conversations from apps such as WhatsApp and Telegram. It can also turn on the camera or stream the screen in real time.

For businesses, that creates a much bigger problem than a compromised phone. An infected device could expose company messages, credentials, customer information, and other sensitive data.

This Threat Is a Wake-Up Call

Attacks like this one remind us that Android devices deserve the same security attention as laptops and servers.  

Mantax Otax is unusual because it combines so many capabilities into one malware package. For businesses, the lesson is straightforward: mobile security can't be an afterthought. Keep Android devices updated and limit application downloads from unknown sources. Mobile phones can hold valuable business data, making them an increasingly attractive target for cybercrime attacks. Protection begins with keeping Android devices updated and limiting application downloads from unknown sources.  

Accessibility permissions also deserve particular attention. Giving malicious software this level of access can put an entire device at risk.

Used with permission from Article Aggregator