Indonesian‑linked Android malware blends ransomware, spying and device hijacking

Security researchers have uncovered a new Android threat dubbed Mantax OTAX that merges ransomware, spyware, credential theft and remote‑control capabilities into a single malicious package. The malware, which appears to be operated by threat actors based in Indonesia, can encrypt user files, harvest one‑time passwords (OTPs) and exfiltrate a range of personal data, effectively turning infected smartphones into multi‑purpose spying tools.

The infection chain begins with users installing sideloaded APKs that masquerade as legitimate applications. Because the software is not distributed through official app stores, it bypasses many of the vetting processes that protect against known malware. Once installed, Mantax OTAX silently requests elevated permissions, allowing it to monitor SMS messages, intercept authentication codes and capture login credentials for banking and social media accounts.

Beyond data theft, the malware’s ransomware component encrypts files stored on the device and displays a demand for payment, typically in cryptocurrency, to restore access. Researchers observed that the ransom note also threatens to publish the stolen OTPs and other sensitive information if the victim does not comply, adding pressure to pay. The dual‑extortion approach mirrors tactics seen in recent Windows‑based ransomware campaigns.

The discovery follows a broader trend of increasingly sophisticated mobile malware that combines multiple malicious functions. Android’s open ecosystem and the popularity of third‑party app marketplaces create a fertile environment for such campaigns. Analysts note that the ability to both spy on users and hold their data hostage makes Mantax OTAX particularly dangerous, as it can be leveraged for financial fraud, identity theft or corporate espionage.

Security firms advise users to avoid installing apps from unknown sources, keep their operating system and security software up to date, and review permission requests carefully. Organizations are urged to implement mobile device management (MDM) solutions and educate employees about the risks of sideloaded applications. As investigators continue to track the group behind Mantax OTAX, the episode underscores the need for heightened vigilance against mobile‑first ransomware and spyware attacks.