How does the Android MantaX Otax malware compromise your personal data and harass users?

A new malware, named MantaX Otax, is spreading fear among Android smartphone users. By stealing personal information and encrypting files, this malicious software goes even further by harassing its victims with threatening messages. Find out in this article everything you need to know to protect your device.

The essentials to remember

• MantaX Otax primarily targets Android devices by exfiltrating sensitive data such as SMS and WhatsApp profiles.
• Its action is particularly effective on devices running Android 9 or earlier versions.
• The second version of this malware includes harassment tactics to force the payment of a ransom.

Imagine receiving a message from a friend inviting you to download an app. You suspect nothing and, with a few clicks, you are trapped by MantaX Otax. This scenario, which might seem like something out of a movie, is unfortunately very real for several Android users, especially in Indonesia. How does this malware manage to cause so much damage? Discover the details of its operation and its implications.

MantaX Otax and the theft of sensitive data

Detected by the zLabs research team at Zimperium, MantaX Otax is a malicious software that exfiltrates essential information, such as SMS and one-time passwords, directly from Android smartphones. It also targets WhatsApp and Telegram profiles, thus compromising the privacy of its victims.

This malware is not found on official stores like the Google Play Store. It spreads through links shared via messaging apps or social networks, often following a social engineering tactic. Once installed, it requests device administrator rights, thus accessing many sensitive features.

File encryption on Android 9 and earlier

MantaX Otax uses a different AES key for each victim to encrypt photos, videos, and documents, which then end up with the .enc extension. This encryption process is particularly effective on Android 9 or older devices. With Android 10, Google introduced Scoped Storage, limiting shared storage access by third-party apps, thus reducing the malware’s effectiveness.

For many users, checking and updating their Android version could be a simple solution to protect themselves. However, a large number of smartphones remain on older versions, making these devices vulnerable.

The harassment mechanisms of MantaX Otax version 2

The second version of MantaX Otax does not just steal data and encrypt files. It adds a layer of harassment. In addition to blocking access to other apps, it bombards victims with threatening voice messages and flashing images, making the user experience unbearable.

This version also opens a chat window on the lock screen to negotiate a ransom, preventing the victim from contacting their relatives or seeking help online. The stolen data serves as additional leverage to force payment.

How does MantaX Otax conceal its activities?

To conceal its activities, MantaX Otax does not hard-code a fixed server address. It uses GitHub to obtain the command address, complicating the work of security teams. The transfer of stolen files is done via Catbox, a legitimate platform, making detection even more difficult.

Protection measures against Android malware

Faced with the growing threat of malware like MantaX Otax, it is crucial to take measures to protect your Android devices. Activating Google Play Protect is a good start, as it can detect some malicious apps before installation. Additionally, favoring downloads from official stores and regularly backing up data are practices recommended by organizations like Cybermalveillance.gouv.fr.

The challenges of mobile security in the era of sophisticated malware

The proliferation of sophisticated malware like MantaX Otax raises major challenges for mobile security. Security publishers, such as Zimperium, must constantly innovate to detect and counter these threats. Users, on the other hand, must remain vigilant and informed about the latest hacking techniques.

With the rapid evolution of mobile technologies, device security becomes a priority for developers and manufacturers. Regular updates and user education are essential to prevent future attacks.

FAQ about MantaX Otax malware

How does MantaX Otax spread on Android devices?

MantaX Otax primarily spreads through links shared on messaging apps or social networks, often after a social engineering contact. It is not available on official stores like the Google Play Store.

Which version of Android is most vulnerable to MantaX Otax?

Devices running Android 9 or earlier versions are the most vulnerable. Since Android 10, Google has implemented Scoped Storage, thus limiting the malware’s effectiveness.

What are the malicious features of the second version of MantaX Otax?

The second version of MantaX Otax includes harassment mechanisms such as threatening voice messages, flashing images, and prevents access to other apps to force the payment of a ransom.

How can I protect my device against MantaX Otax?

To protect your device, make sure to use the latest version of Android, activate Google Play Protect, download only apps from official stores, and regularly back up your data.

[New] 4 ebooks on digital marketing available for free download

Did you enjoy this article? Receive our next articles by email.

Other articles on the same topic: