# New Android malware encrypts files, steals data, and harasses victims

> **Open Intelligence Dossier** · First detected: 2026-09-11 18:07 UTC · Category: Technology

## Executive Summary
The newly discovered Mantax Otax malware targets Android users with a combination of file encryption, data theft, and invasive surveillance.

## Intelligence Brief
A new strain of Android malware, identified as Mantax or Mantax Otax, is currently targeting mobile users with a hybrid approach to cybercrime. According to coverage from BleepingComputer and TechRadar, the attack functions as a cocktail of cybercrime by combining traditional ransomware capabilities with sophisticated spyware tools. The malware is capable of encrypting a victim's files to lock them out of their own data while simultaneously executing data theft operations. Reports indicate that the software can record device screens, steal one-time passwords (OTPs), and secretly take photographs of the victims to facilitate extortion and harassment. Multiple cybersecurity outlets are tracking the deployment of this threat. Infosecurity Magazine and Zimperium emphasize that the malware integrates spyware functionality directly into its ransomware framework.


Specifically, India Today reports that researchers have issued warnings regarding the malware's ability to spy on WhatsApp communications and steal sensitive OTPs. These findings highlight a shift toward multifaceted attacks where the goal is not just a financial payout for decryption, but the active theft of personal credentials and the use of surveillance for the purpose of harassing the affected individuals. Contextual data provided by Zimperium identifies this specific threat as Indonesian mobile ransomware. This geographic origin suggests a regional focus or a development hub within Indonesia. The significance of this trend lies in the integration of multiple attack vectors into a single package; by combining screen recording and photo capture with file encryption, the attackers can gather leverage over the victim beyond the mere loss of files. The use of OTP theft specifically indicates an attempt to bypass security measures on other accounts and financial services, increasing the total risk to the user.


Future developments to monitor include the methods of distribution and the specific targets of the harassment campaigns. While the current reports from CyberSecurityNews and HotHardware focus on the "dirty tricks" and surveillance capabilities, coverage does not yet specify the exact delivery mechanism or the total number of compromised devices. Stakeholders should watch for updates on whether the malware is evolving to target specific industries or if it remains a broad threat to the general Android user base. The continued ability of the software to secretly access the camera and screen remains a primary point of concern for security researchers.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| CyberSecurityNews | New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims | [Source Link](https://news.google.com/rss/articles/CBMiY0FVX3lxTE9mekI0WnBxWHdpQlpuRzRkci05aXJuZmh2SUZUMnhaNjV5NFA0ZEhoUjdzdUpmX3RFUFl3RTlTYmJHS2ZIdEVnZ2VMZUNVLUYtRGFVRGM5Ym9DeUxVRzBuaFYySdIBaEFVX3lxTE9yM1VMQUlYOUZWX3FQN0JlQXh0MWxTNjVqNFFkbUk3bGtfWmdqTDFzN3lpQWswa0xQWTZ2c1dlelg5TDYxaFF5amh5aG81VG5SYWJXdGN2M3lkMjNrd3NiTXZqVjdCbWR4?oc=5) |
| HotHardware | Devious Mantax Malware Uses Dirty Tricks To Extort Android Users | [Source Link](https://news.google.com/rss/articles/CBMickFVX3lxTE40SEhnZzVleE54dUl0ZUp6c3JmVjA2OWhOQ05NQzBCeFlxUW5YUUJJQVdENHZfaElFaHFKcWZTOVZUY29JejROMGhoNzlScWdXQnFuOFVtVm5KdmdMSzlkYVpOV2dTSDVHemcwazlxQ2RuZw?oc=5) |
| cybersecuritynews.com | New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims | [Source Link](https://news.google.com/rss/articles/CBMiY0FVX3lxTE9mekI0WnBxWHdpQlpuRzRkci05aXJuZmh2SUZUMnhaNjV5NFA0ZEhoUjdzdUpmX3RFUFl3RTlTYmJHS2ZIdEVnZ2VMZUNVLUYtRGFVRGM5Ym9DeUxVRzBuaFYySdIBtwJBVV95cUxNSzR3RGZQV25pZHhmTGwtYnVtak1VQS1YbWtzUTk5dGV1WWk2bGxpNTJ1clBvb1V1Y1F6bTdUVDF3dTlwVHVsaWFydWQ1LTRha1lrTy1BT2N6YnRSRndnenBtUmVwSkVyZmZkNHF1MGpIT2ZYT1Z5LWJkVnhIUVctYmMyVW10dHB1UFJNajNlMS0tWmxPVnBnY19VdE91Qy1SUjdQRGtOSURmQTJsMGtkUUxfTVNWd1VUbHJYaXZ6aEI5YkJ5c25jU0VkRDFfQVN6ekYyeURHSlo5cFlrTGhKdTFUTjhVblNqRW1vaFVYRTR) |
| TechRadar | A new Android attack combines malware and ransomware in a cocktail of cybercrime | [Source Link](https://news.google.com/rss/articles/CBMiuwFBVV95cUxQNnkwY2duNS1xdTI0TGNUODZEWTZIWUYwRnVSV24zUHpwNllxcXk3cktZcy1oY0NhT3MxdHQxRnJzT0ZCNFp0UEppeWdGSlRlRDl2VlF2MXBuOWJKQ2dRb0V6TjNScVhHYU9EOXhmVG13MjB5S0pRQTdUOWo2WVU3OGZSZlRxUjhZUXF4ai13YTFKbDdxSlJsSUttUlhwamNHX0VhRVFoc25SZnFvdkFFZkxYNXBOS0tCWHpz?oc=5) |
| Infosecurity Magazine | MantaxOtax Android Malware Combines Ransomware With Spyware | [Source Link](https://news.google.com/rss/articles/CBMiekFVX3lxTE1GMzZRdmVQaDRHWXZuN00xUXR4ZkVRWXNQSThXUmRScTVyc0lUTGtuQ3g4Sm5WWElVSlRFQ201YUhpVllKWG5DOFNpSmZkdUVvNklnSUJOUGhMM2UzbTBfYXRCY0E5NXh6RFBrakgyVVZWNnBjUUpJUk13?oc=5) |
| India Today | Researchers warn about new Android malware that can steal OTPs, spy on WhatsApp and harass victims | [Source Link](https://news.google.com/rss/articles/CBMi9wFBVV95cUxOYzVFemlIME1mUWNsVHQ1UlVFaHZNZXJGQkpjMTl6dko3ZHJlb2tIRnFiNFpOTlVNcmtPQ1BPbXpSUzlSakFzVlg3bm83TWlxV1p3QUd1NFF4RENjRUJWQVAxemRRdnk3eVZWaFpONjdNYjdjR1d4bmlOTHpUVk56d0dKZ0NqWlFRRXNuZWQtaFdfM1JsMHlPREVac2FYNFV2NnVxZHkzWnc2ODNmM19oWEE0YnVFa1JZU1dxUzRSZ2JzbFo1WXcyaEZUNENkS0dvbFV6SzFiUnIwU2pmcU1NNHk5UXFlZEFYbnhnbkxlZFNmU1VSWnhV?oc=5) |
| Zimperium | Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration | [Source Link](https://news.google.com/rss/articles/CBMilwFBVV95cUxNT0RDNTNJTHNkbnZUX1FYVGFVREFsRjRoLXJTSWpLSDF3UFNSdlI4VUZWb2lCWkFuWFRGTmxjeENOc19POE1yM09xUi1feDZsNk1oZTFLNVlRNjBVem5ubGFmVzltTHZsWHBjY0pmcmgzZ2xxOE5BVUJhRndUSGJ1MnFSVS1ycWl6RGs1clF0TFJaV0lZS1VV0gGnAUFVX3lxTE0xR1c4bDNuUldfWmdIaTBFRk1HUjItRXVuaHBQV3V3cHNYZmtIREd2dDFoMnd2aXQ5V2liZE1SZzdJMDZYQjRJX2Nkc01lZ0l4SUNnelBWM293a0J1eHJzWkp1MW96ME1BcUNXcUNBZGpZLWpoMi1tM2lIRHNMcEx0SXZfN3lNdUFzczU0RmpEa2VlM0VjdWxoWGZUazV4Q003YUstZDFn?oc=5) |
| BleepingComputer | New Android malware encrypts files, steals data, and harasses victims | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxNZzV1ZmJac3pLZHlibmhtWmJOOTkzZFVmWGZ0REZMOS1jaVFTUVVWMFVmVTJJSHhtcUxDdVpQa1dtNmtjNHRhSVFvQXZKTVJHQjRhUmIwejc3bHczOGJPY0ZORUxlSnJzRDlvZDc5dUhoNi1jMGtWZlFKX2QyRzdVWGlsQldaUUZNaGdwX2k4OW14eXM0TFRmd3d3NmczSEM0ckxtdC1FOWlrc19HSF9OczhzM1AxZ9IBuwFBVV95cUxNNlh2WnRUTDhSSVlrQ2xRbFN4SVpNckhDU28wVC0tS3pMcnNta2gxc2xJaHRHSnpCTm9tS0ZZeFVLNG9kLUtMeDREbUpYN01JNkdlQlJNc0I2aHd2ZHRWV09BdmFjbjc3LTQ0ZVhKNHR2NXpmMzFib01HQlc1U1o4aVMzLVYwRENkamNZbEszdjE5bGdDcnRGOWFzcjZ) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-11/new-android-malware-encrypts-files-steals-data-and-harasses-victims*