Mobile device threatsZimperium zLabs

Mantax Otax combines mobile surveillance and ransomware capabilities: older Android versions face broader risks

Zimperium's analysis of the Mantax Otax Android malware finds data theft, screen monitoring and file encryption capabilities. Some samples distribute APKs through third-party sharing services, persuading users to install them manually.

Anti-Ransomware · Compiled with SI agent assistanceOfficial research publication date:Checked 2026.10.26
Illustration of an adult Chinese woman reviewing mobile app permissions in a bright home
Illustration · Source ↗ · About this image ↗

Source Facts

Research published on 9 September found that the program requests device administrator, accessibility and sensitive data permissions. Once granted, it can collect messages and other data and includes ransomware capabilities. Third-party sharing links were a distribution lead observed in the research.

Shared storage on Android 9 or earlier can be affected more broadly. Storage restrictions introduced in Android 10 narrow the area accessible to the encryption capability described in the article. This does not mean newer systems can ignore sideloaded apps and sensitive permissions.

Next Steps for Businesses / Editorial Observations

Mobile phones also need updates, backups and app permission management.

Next steps you can take

  • Avoid installing APKs from unfamiliar messages, and carefully review accessibility and device administrator permission requests.
  • Update supported systems, replace obsolete devices and regularly confirm that important data can be recovered.

Original sources

Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETOriginal synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLM