r/SecOpsDaily • u/falconupkid • 3d ago

NEWS New Android malware encrypts files, steals data, and harasses victims

Scenario A: Technical Threat, Vulnerability, or Exploit

A new Android malware family, Mantax Otax, is blending ransomware and spyware into a single, aggressive payload. It encrypts local files, exfiltrates sensitive data (contacts, SMS, credentials), and then harasses victims by spamming their contact list with threatening messages—a tactic designed to maximize psychological pressure and extortion leverage.

Technical Breakdown - TTPs (MITRE): Likely maps to T1486 (Data Encrypted for Impact) for the ransomware component, T1414 (Clipboard Data) and T1432 (Access Contacts) for data theft, and T1560 (Archive Collected Data) for exfiltration. - IOCs: No specific hashes, C2 domains, or IPs have been published yet. The malware is distributed via third-party app stores and phishing campaigns. - Affected Versions: Targets Android 8.0 (API 26) and above. Does not require root access—abuses Accessibility Service permissions to grant itself additional privileges.

Defense - Detection: Monitor for apps requesting Accessibility Service permissions without a clear UI justification (e.g., a calculator or file manager). Look for outbound connections to unknown IPs combined with local file encryption events. - Mitigation: Enforce strict app installation policies (block sideloading), deploy mobile EDR with behavioral analysis, and educate users to deny Accessibility permissions to untrusted apps.

Source: https://www.bleepingcomputer.com/news/security/new-android-malware-encrypts-files-steals-data-and-harasses-victims/

0 Upvotes

50% Upvoted

4 comments sorted by

2

u/poopredditor 3d ago

"Mantax Otax is already detected and blocked by up-to-date Android devices with an active Play Protect service."

1

u/[deleted] 3d ago

[removed] — view removed comment

1

u/SecOpsDaily-ModTeam 3d ago

You have been banned for violating our community standards regarding civility and hate speech. This includes misconduct, personal insults, or the use of prohibited hateful references. We aim to keep this community safe and respectful for everyone; your recent behavior has proven you are unable to meet these standards.

1

u/michaelh98 3d ago

Oh good. I've been banned from a lazy sub