Devious Mantax Malware Uses Dirty Tricks To Extort Android Users

The security research team at Zimperium’s zLabs has uncovered a new strain of malware targeting Android devices, which not only looks to pilfer a victim’s data but also inflict maximum psychological damage. It has been dubbed 'Mantax Otax' and is described as “sophisticated and highly aggressive,” and is only getting more potent as new versions are released into the wild.

Mantax Otax leverages sideloading on Android. For those unaware, sideloading is used to install apps that might not be available through the Google Play Store, including third-party stores such as the Epic Games Store. However, malicious actors are tricking users into installing this malware using phishing, social engineering or through shared links.


Once installed on a device, it immediately begins scanning for photos, videos, documents and databases, which are then encrypted. It’s also capable of extracting personal user data, including hardware specifications, real-time location data, and a complete overview of a victim’s browsing history. Moreover, as with a lot of mobile malware, it uses a fake lock screen to steal a device’s credentials to enable its nefarious activity.

For those unfortunate enough to be running Android 9 or older there’s an even more thorough scan, which leads to one of the worst aspects of this malware, the psychological attacks. It will replace a victim’s photos with images created by malicious actors that have messages such as "Your files have been encrypted. Pay to decrypt."

The psychological attacks are even worse on the newer version of Mantax Otax. The newest version includes dialog spamming with intrusive alerts, will randomly play full screen videos that a victim has no control over, displays “jumpscare” overlays that include strobing effects, and utilizes Android’s Text-to-Speech engine to vocalize an attacker’s threats.

While Android enthusiasts have been less than pleased with Google’s push to lockdown the OS, its new policies are designed to tamp down on attacks such as this one. Hopefully it’s a successful tactic that ends up keeping more users safe, rather than an annoyance for more technical users.