Unveiling the Threat: How Android Malware Invades Privacy by Taking Covert Photos

Mantax Otax Android Malware: A Threat to Older Android Devices

In recent developments, a malicious software known as Mantax Otax has been identified as a serious threat to Android devices, particularly those running older versions of the operating system. This malware is capable of encrypting files, stealing sensitive information, and extorting users for ransom payments.

One of the key features of Mantax Otax is its ability to retrieve commands from a command-and-control (C2) domain hosted on GitHub. Once activated, the malware collects information about the victim, such as their location, mobile network provider, Android version, and device ID. These details are then sent back to the C2 server, which can issue commands for execution through Firebase or WebSockets.

Security experts from Zimperium have noted that Mantax Otax specifically targets devices running older versions of Android. The malware scans shared storage for specific file types and encrypts them using a victim-specific AES key obtained from the C2 server. It then deletes the original files and appends the file extension ‘.enc’ to the encrypted copies.

In addition to file encryption and extortion, Mantax Otax is capable of stealing lockscreen PINs, reading text messages and one-time passwords, accessing call logs, contacts, browser history, app lists, WhatsApp messages, Google account information, and location data. Furthermore, the malware can covertly take photos using the device’s camera.

Fortunately, users running Android 10 or later are largely protected from the full impact of Mantax Otax, as the ransomware module only functions fully on devices running Android version 9 or older. This underscores the importance of updating to the latest Android version to mitigate security risks.

Currently, Mantax Otax appears to be targeting users in Indonesia, posing a significant threat to their personal data and privacy. To safeguard against this malware and similar threats, users are advised to enable Google Play Protect, an Android virus scanner that can detect and remove Mantax Otax from infected devices.

Protecting Yourself from Mantax Otax

To protect your Android device from Mantax Otax and other malware threats, it is essential to follow these security measures:

• Enable Google Play Protect to detect and remove malware
• Regularly update your device to the latest Android version
• Avoid downloading apps from unverified sources
• Be cautious when clicking on links or downloading files from unknown sources
• Use strong and unique passwords for all accounts