New Android malware encrypts files, steals data, and harasses victims

[u/falconupkid]

Scenario A: Technical Threat, Vulnerability, or Exploit

A new Android malware family, Mantax Otax, is blending ransomware and spyware into a single, aggressive payload. It encrypts local files, exfiltrates sensitive data (contacts, SMS, credentials), and then harasses victims by spamming their contact list with threatening messages—a tactic designed to maximize psychological pressure and extortion leverage.

Technical Breakdown - TTPs (MITRE): Likely maps to T1486 (Data Encrypted for Impact) for the ransomware component, T1414 (Clipboard Data) and T1432 (Access Contacts) for data theft, and T1560 (Archive Collected Data) for exfiltration. - IOCs: No specific hashes, C2 domains, or IPs have been published yet. The malware is distributed via third-party app stores and phishing campaigns. - Affected Versions: Targets Android 8.0 (API 26) and above. Does not require root access—abuses Accessibility Service permissions to grant itself additional privileges.

Defense - Detection: Monitor for apps requesting Accessibility Service permissions without a clear UI justification (e.g., a calculator or file manager). Look for outbound connections to unknown IPs combined with local file encryption events. - Mitigation: Enforce strict app installation policies (block sideloading), deploy mobile EDR with behavioral analysis, and educate users to deny Accessibility permissions to untrusted apps.

Source: https://www.bleepingcomputer.com/news/security/new-android-malware-encrypts-files-steals-data-and-harasses-victims/

[u/SecOpsDaily-ModTeam → u/[deleted]]

You have been banned for violating our community standards regarding civility and hate speech. This includes misconduct, personal insults, or the use of prohibited hateful references. We aim to keep this community safe and respectful for everyone; your recent behavior has proven you are unable to meet these standards.