MantaxOtax Android Malware Combines Ransomware With Spyware

MantaxOtax is an Android malware family that fuses file-encrypting ransomware with extensive spyware and remote-control features: it requests device-admin and Accessibility permissions, encrypts or overwrites user files (depending on Android version), intercepts PINs and OTPs, harvests messages and account data, abuses MediaProjection for screen capture/streaming, and uses GitHub-resolved C2 and Firebase for communications; Zimperium links samples to Indonesian threat actors and notes distribution via sideloading and server misconfigurations exposing extortion dialogs.