MantaxOtax keys its Android ransomware to each victim's Android ID

The one fixed element in that setup is the repository. Rotating a domain costs the operators a commit; matching them costs defenders a new blocklist entry after every rotation ^[5]. The resolver, not the C2, is the durable indicator, and it sits on a code-hosting platform with an abuse desk rather than on a bulletproof host.

Zimperium found samples distributed as a standalone Android package on a third-party file-sharing service, so the infection starts with a user tapping through an unknown-sources warning ^[3]. Accessibility, the last permission in the chain, is where the surveillance lives: it is how the malware reads WhatsApp profiles and messages and lifts Telegram credentials and chat histories ^[13]. The rest of the collection set is broad and mostly unremarkable for this class, with two entries that matter more than the ransom: SMS messages including one-time passwords, and linked Google accounts ^[12].

The ransomware half is version-dependent. On Android 9 and earlier it walks shared external storage, encrypts with AES, purges the originals and leaves .enc copies ^[6]. On Android 10 and later, Scoped Storage confines the scan to the app's own external files directory, which leaves little worth encrypting ^[8]. The surveillance half is indifferent to that boundary, since Accessibility, MediaProjection screen capture and silent camera use work the same on a current handset ^[13][14]. On a modern device the extortion leverage is therefore the routine that poses as a system lock while intercepting the PIN, plus the persistent locking, application blocking and touch-swallowing overlay in the WebSocket-based second version ^[20].

Per-device keying settles the decryption question. Each key is fetched from the C2 against the device's Android ID, so no two victims share one ^[7]. A sample pulled apart in a lab yields nothing reusable, and recovery for an Android 9 victim runs through the operators' key store or not at all.

Some builds skip leverage for attrition: repeating alert dialogues, full-screen video overlays, text-to-speech that makes the handset say the attacker's words, and image popups spawning every 600 milliseconds ^[17], which is 100 of them a minute ^[19]. Victims' own image files are also overwritten with ransom graphics ^[9].

Negotiation ran through an on-screen chat interface on Firebase, and a server misconfiguration exposed some of those extortion dialogues along with a screenshot of what appears to be the operators' control panel ^[10][15]. Targeting is inferred rather than counted: Zimperium cited language indicators and recovered victim files as the basis for the Indonesian read ^[15].

THost9, reported the same week, cloned banking apps into an isolated work profile to break the link between a malware alert and the fraud that followed ^[18]. One family is boxed in by Android's storage isolation, the other used the platform's profile isolation as cover ^[8][18]. The controls that bite MantaxOtax arrive before any of it: install policy for unknown sources, and knowing which apps on a managed fleet hold device administrator and Accessibility ^[3][4].