GoKawiilMantax Otax Android Malware Blends Ransomware and Spyware to Extort Indonesian Victims
Security firm Zimperium has identified a new Android malware called Mantax Otax that combines file encryption with data theft, distributed via malicious APKs outside Google Play through phishing lures aimed at Indonesian users. Once installed, it abuses Accessibility permissions to harvest device data, report to a GitHub-hosted command server, and on older Android versions (9 and below) encrypts files, replaces images with ransom notes, and opens a Firebase-hosted chat to negotiate payment. Researchers exploited a misconfigured Firebase server to expose the attackers' actual conversations with victims.
GoKawiil's interpretation of the reporting above, not reported fact.
The malware shows how mobile threats are converging ransomware and spyware tactics while relying on legitimate cloud infrastructure like GitHub and Firebase to evade detection and manage operations cheaply. Its reliance on outdated Android security models highlights the ongoing risk to users who don't update their OS, since Android 10's Scoped Storage largely blocks the encryption capability.
- Mantax Otax targets Android 9 and earlier devices, exploiting weaker storage protections to encrypt files.
- Distribution relies on sideloaded APKs and social engineering rather than the Google Play Store.
- A Firebase server misconfiguration allowed researchers to uncover attacker-victim ransom negotiations.
Bitdefender Mobile Security for Android — With Android malware like Mantax Otax spreading through sideloaded APKs and phishing links, an on-device security app adds a layer of scanning and web protection Google Play alone won't give you. Bitdefender Mobile Security is a well-known subscription key card that installs in minutes and watches apps and links for malicious behavior.
See Bitdefender Mobile Security for Android on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “New Android malware encrypts files, steals data, and harasses victims”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.