Mantax Otax is an Android malware targeting devices running Android 9 and earlier. It combines ransomware and spyware capabilities, encrypting files with AES and appending .enc extensions. The malware requests extensive permissions, including device administrator and accessibility access, to steal sensitive data such as screen recordings, browser history, PINs, contacts, call logs, SMS, and chats from WhatsApp and Telegram. It communicates with command and control servers via HTTPS and WebSockets, using dynamic domain resolution through GitHub. Version 2 introduces advanced features like UI hijacking, screen blocking, touch input interception, harassment capabilities, and remote text-to-speech. Data exfiltration is facilitated through Firebase and Catbox services, enabling a double-extortion scheme with an interactive ransom chat portal.
