A newly reported Android malicious software strain, referred to as Mantax Otax, combines three high-impact behaviors in one package: file encryption, sensitive-data theft, and spam/harassment against victims. Based on the public summary available to defenders, there are no CVE identifiers, CVSS scores, package names, hashes, or C2 domains published in the source item; therefore this guide deliberately avoids invented indicators and focuses on behavior that a SOC, mobile IR team, or MDR provider can operationalize today.
The risk is not limited to a lost phone. A compromised Android device can expose corporate email, MFA prompts, authenticator backups, contact lists, SMS one-time codes, photos, browser cookies, and files synced through work profiles. If the malware abuses accessibility services, device admin rights, notification access, overlay permissions, or default SMS handling, it can also harvest credentials, approve fraudulent prompts, block user attempts to remove it, and turn the device into a harassment and social-engineering relay against the victim's contacts.
Treat confirmed or suspected Mantax Otax activity as a mobile ransomware plus account-compromise incident, not a nuisance infection. The defensive priorities are: isolate the device, preserve evidence before wiping, revoke sessions and credentials that may have been exposed, identify whether work-profile data was encrypted or staged, and hunt for sideloading, permission escalation, accessibility abuse, bulk file modification, and suspicious outbound traffic.
Technical Analysis
Affected platforms and likely attack surface
- Platform: Android phones and tablets; risk is highest where users can install apps from outside Google Play, where accessibility services are broadly allowed, or where devices are not enrolled in EMM/UEM with compliance policies.
- Enterprise exposure: BYOD work profile, corporate email and chat on mobile, mobile MFA/approval apps, password managers, cloud storage sync clients, SMS-based OTP, contact-driven spear phishing, and helpdesk workflows that rely on phone-number identity.
- No CVE is provided in the news summary. Do not create one. There is also no public confirmation in the supplied source of CISA KEV inclusion, a vendor advisory, an in-the-wild exploit chain against an Android OS bug, or a specific CVSS. The immediate issue is malicious-app capability and user/permission abuse rather than a named patched vulnerability.
Defender-oriented attack chain
A practical model for this threat is:
- Delivery and installation through social engineering, smishing, malicious ads, cloned utility apps, third-party app stores, or direct APK links. Enterprise telemetry often shows an APK install event, package installer activity, Play Protect warnings ignored, or
unknown sourcesenabled. - Permission expansion using device admin, accessibility service enrollment, notification listener access, overlay/display-over-other-apps, SMS/phone/contacts/photos/files permissions, battery-optimization exemption, and foreground-service persistence.
- Surveillance and theft through reads of contacts, SMS, notifications, call logs, files, photos, clipboard, screenshots, keylogging via accessibility events, and capture of authentication prompts.
- Encryption impact through rapid create/rename/delete/write bursts across shared storage, especially documents, photos, downloads, backups, and app-external directories. Mobile ransomware often fails noisily against modern scoped storage, but even partial encryption of synced folders can corrupt cloud copies.
- Harassment and propagation through bulk SMS, messaging-app automation, contact-list exfiltration, and repeated calls or notifications designed to pressure payment or shame the victim.
- Command and control / exfiltration to attacker infrastructure using HTTPS, WebSocket, MQTT-like telemetry, DNS-over-HTTPS, or abused legitimate services. Without published IOCs, hunt for uncommon POST bodies, repeated connections immediately after install, and traffic correlated with accessibility or device-admin enrollment.
Exploitation status
- Public exploit/PoC: Not identified in the provided source.
- Confirmed active exploitation: The source describes a new malicious strain in circulation; treat as active until disproven by your mobile telemetry and EMM compliance data.
- CISA KEV: Not applicable from the information supplied because no CVE is named.
- Primary exploitation requirement: user-assisted installation plus dangerous runtime permissions or accessibility/device-admin grant. That means prevention is heavily dependent on install-source control, mobile phishing resistance, EMM policy, and fast user reporting.
Detection & Response
The rules below are intentionally behavior-based. They are written for environments that ingest mobile EDR, EMM/UEM, proxy/DNS, and identity telemetry into Microsoft Sentinel, Splunk with Sigma, Elastic, or a data lake. Tune thresholds to your fleet baseline; do not deploy high-frequency mobile battery or accessibility events as-is in a noisy BYOD environment.
YAML
---
title: Android Accessibility or Device Admin Grant Followed by Bulk File Changes
id: 9b3e7c41-2ad5-4e89-a312-7f0c4a9d21b6
status: experimental
description: Detects suspicious sequence where an Android app obtains high-risk permissions and soon after performs mass file create/rename/delete consistent with ransomware or destructive staging.
references:
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1580/
author: Security Arsenal
date: 2026/05/21
tags:
- attack.impact
- attack.t1486
- attack.discovery
- attack.t1580
logsource:
category: file_event
product: android
detection:
selection_files:
Operation|contains:
- 'create'
- 'rename'
- 'delete'
- 'write'
TargetFilename|contains:
- '/Documents/'
- '/Download/'
- '/DCIM/'
- '/Pictures/'
- '/Backups/'
selection_permissions:
Permission|contains:
- 'BIND_ACCESSIBILITY_SERVICE'
- 'BIND_DEVICE_ADMIN'
- 'SYSTEM_ALERT_WINDOW'
- 'BIND_NOTIFICATION_LISTENER_SERVICE'
- 'WRITE_EXTERNAL_STORAGE'
- 'MANAGE_EXTERNAL_STORAGE'
condition: selection_files and selection_permissions
falsepositives:
- Backup, photo-gallery, file-manager, and enterprise sync apps with documented business need
level: high
---
title: Android Third-Party Install Immediately Followed by SMS Contacts or Notification Access
id: 6d2f8b10-5d7a-4a4f-9a55-2e7c0b1a8f44
status: experimental
description: Identifies newly installed non-Play-store packages requesting harassment and data-theft permissions within a short window, a common spyware and mobile-ransomware pattern.
references:
- https://attack.mitre.org/techniques/T1476/
- https://attack.mitre.org/techniques/T1582/
author: Security Arsenal
date: 2026/05/21
tags:
- attack.collection
- attack.t1119
- attack.initial_access
- attack.t1476
logsource:
category: process_creation
product: android
detection:
selection_install:
Image|endswith:
- '/com.android.packageinstaller'
- '/com.google.android.packageinstaller'
CommandLine|contains:
- 'install'
- 'apk'
selection_store:
InstallerPackageName|contains:
- 'com.android.vending'
selection_permissions:
Permission|contains:
- 'READ_SMS'
- 'SEND_SMS'
- 'READ_CONTACTS'
- 'READ_CALL_LOG'
- 'RECORD_AUDIO'
- 'READ_NOTIFICATIONS'
condition: selection_install and not selection_store and selection_permissions
falsepositives:
- Enterprise app distribution through approved MDM private catalogs
- User-installed open-source apps from trusted repositories after allowlisting
level: medium
---
title: Mobile Device Outbound Spike After Accessibility Enrollment
id: 21c5a9b0-8ec1-4d52-b718-1f6a0d5c9e77
status: experimental
description: Detects short-window outbound network bursts following accessibility-service or device-admin activation, suggesting credential capture, exfiltration, or C2 registration.
references:
- https://attack.mitre.org/techniques/T1041/
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/21
tags:
- attack.exfiltration
- attack.t1041
- attack.command_and_control
- attack.t1071
logsource:
category: network_connection
product: android
detection:
selection_network:
DestinationPort:
- 443
- 8443
- 5228
- 8883
Initiated: 'true'
selection_context:
ContextEvent|contains:
- 'accessibility_service_enabled'
- 'device_admin_enabled'
- 'notification_listener_enabled'
condition: selection_network and selection_context
falsepositives:
- Accessibility tooling for disabled users
- Approved enterprise kiosk and digital-signage agents
level: medium
KQL — Microsoft Sentinel / Defender
// Sentinel/Defender hunt: Android package installs followed by risky permission grants and network activity
// Requires Defender for Endpoint on Android, EMM/UEM logs, or equivalent mobile telemetry normalized into Device* tables.
let lookback = 14d;
let installs = DeviceEvents
| where Timestamp >= ago(lookback)
| where ActionType has_any ('AppInstalled','PackageInstalled','Install')
| extend PackageName = tostring(parse_json(AdditionalFields).PackageName)
| where isnotempty(PackageName)
| project InstallTime=Timestamp, DeviceId, DeviceName, PackageName, ActionType, ReportId;
let risky = DeviceEvents
| where Timestamp >= ago(lookback)
| where ActionType has_any ('PermissionGranted','AccessibilityServiceEnabled','DeviceAdminActivated','NotificationListenerEnabled')
| extend Permission = tostring(parse_json(AdditionalFields).Permission)
| where Permission has_any ('ACCESSIBILITY','DEVICE_ADMIN','SMS','CONTACTS','CALL_LOG','NOTIFICATION','STORAGE','RECORD_AUDIO')
| project RiskTime=Timestamp, DeviceId, DeviceName, Permission, ActionType, ReportId;
let net = DeviceNetworkEvents
| where Timestamp >= ago(lookback)
| where RemotePort in (443,8443,5228,8883)
| project NetTime=Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName;
installs
| join kind=inner risky on DeviceId
| where RiskTime between (InstallTime .. InstallTime + 15m)
| join kind=leftouter net on DeviceId
| where isnull(NetTime) or NetTime between (InstallTime .. InstallTime + 30m)
| summarize FirstSeen=min(InstallTime), Permissions=make_set(Permission), RemoteEndpoints=make_set(RemoteUrl), Actions=make_set(ActionType) by DeviceName, DeviceId, PackageName
| where array_length(Permissions) >= 2 or array_length(RemoteEndpoints) > 0
| order by FirstSeen desc;
// Companion hunt: mass file events on onboarded Android or synced folders from mobile clients
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType has_any ('FileCreated','FileRenamed','FileDeleted','FileModified')
| extend Folder = tostring(parse_json(AdditionalFields).FolderPath)
| where Folder has_any ('Documents','Download','DCIM','Pictures','Backups')
| summarize FileOps=count(), Ops=make_set(ActionType), Paths=make_set(Folder) by DeviceName, DeviceId, bin(Timestamp, 10m)
| where FileOps > 200
| order by Timestamp desc;
// Proxy/DNS angle where mobile traffic is visible through Secure Web Gateway or DNS logs
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where DestinationPort in (443,8443)
| where DeviceProduct has_any ('Android','Mobile','Zscaler','Palo Alto','Fortinet','DNS')
| summarize Bytes=sum(tolong(SentBytes)+tolong(ReceivedBytes)), Hits=count(), Destinations=make_set(DestinationHostName) by SourceHostName, SourceIP, bin(TimeGenerated, 1h)
| where Hits > 300 or Bytes > 50000000
| order by Bytes desc;
VQL — Velociraptor
-- Hunt admin/build workstations for APK staging and sideload tooling that may support Mantax Otax distribution
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)adb|fastboot|apksigner|zipalign|bundletool|install-multiple|pm install'
OR Exe =~ '(?i)adb.exe|fastboot.exe|apktool|jadx|apksigner'
-- Look for recently created APK payloads, staging archives, and command history on analyst/build hosts
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/Downloads/*.apk')
WHERE Mtime > Now() - 1209600
ORDER BY Mtime DESC
-- Network connections from sideload/debug tools outside approved build windows
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status, CommandLine
FROM netstat()
WHERE CommandLine =~ '(?i)adb|fastboot|emulator|qemu|genymotion'
AND Status =~ 'ESTABLISHED'
Bash / Shell
#!/usr/bin/env bash
# Mantax Otax mobile triage helper for a USB-authorized test device or lab handset.
# Default mode is read-only audit. Use --enforce to disable unknown sources and revoke high-risk grants interactively.
set -euo pipefail
ENFORCE=0
[ "${1:-}" = "--enforce" ] && ENFORCE=1
need() { command -v "$1" >/dev/null 2>&1 || { echo "missing $1" >&2; exit 1; }; }
need adb
adb wait-for-device
OUT="mantax_triage_$(adb shell getprop ro.serialno | tr -d '\r')_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"
adb shell getprop ro.build.version.release > "$OUT/android_version.txt"
adb shell getprop ro.build.version.security_patch > "$OUT/security_patch.txt"
adb shell pm list packages -3 > "$OUT/third_party_packages.txt"
adb shell pm list packages -s > "$OUT/system_packages.txt"
adb shell dumpsys device_policy > "$OUT/device_policy.txt"
adb shell settings get secure enabled_accessibility_services > "$OUT/accessibility_services.txt"
adb shell settings get secure notification_listeners > "$OUT/notification_listeners.txt"
adb shell settings get global install_non_market_apps > "$OUT/unknown_sources_global.txt" || true
adb shell settings get secure install_non_market_apps > "$OUT/unknown_sources_secure.txt" || true
adb shell dumpsys package > "$OUT/package_dump.txt"
adb shell cmd usagestats list > "$OUT/usagestats.txt" || true
adb shell dumpsys jobscheduler > "$OUT/jobscheduler.txt"
adb shell dumpsys alarm > "$OUT/alarm.txt"
awk '{print $2}' "$OUT/third_party_packages.txt" | sed 's/^package://' | while read -r pkg; do
[ -z "$pkg" ] && continue
adb shell dumpsys package "$pkg" > "$OUT/pkg_${pkg//[^A-Za-z0-9_.-]/_}.txt" || true
grep -E 'android.permission.(READ_SMS|SEND_SMS|READ_CONTACTS|READ_CALL_LOG|RECORD_AUDIO|SYSTEM_ALERT_WINDOW|MANAGE_EXTERNAL_STORAGE|BIND_ACCESSIBILITY_SERVICE|BIND_DEVICE_ADMIN|BIND_NOTIFICATION_LISTENER_SERVICE)' "$OUT/pkg_${pkg//[^A-Za-z0-9_.-]/_}.txt" >> "$OUT/high_risk_permissions.txt" || true
done
if [ "$ENFORCE" -eq 1 ]; then
adb shell settings put global install_non_market_apps 0 || true
adb shell settings put secure install_non_market_apps 0 || true
adb shell cmd appops set --uid "$(adb shell shell echo \$UID 2>/dev/null || echo 0)" REQUEST_INSTALL_PACKAGES deny || true
echo "Review $OUT before removing packages. Use adb shell pm disable-user --user 0 <pkg> only for confirmed malware with EMM approval." >&2
fi
echo "Triage bundle written to $OUT"
echo "Next: compare high_risk_permissions.txt with EMM allowlist, capture network logs, then isolate device."
Detection engineering notes
- Do not chase fake IOCs. The provided source does not publish hashes, package IDs, certificates, C2 domains, or ransom-note names. If your threat feed claims those values, require provenance and expiration dates before blocking.
- Sequence beats single events. A contact-reading flashlight app is noisy; an off-store install, accessibility grant, notification access, mass file churn, and an outbound HTTPS burst in 30 minutes is high confidence.
- Use EMM state as a detection source. Unknown sources enabled, Play Protect disabled, USB debugging on, missing security patch, device-admin list changes, and accessibility-service additions are often more reliable than network signatures on mobile.
- Protect identity after containment. If SMS, notifications, email, authenticator, or contacts were exposed, reset sessions even if the device looks clean. Mobile spyware commonly yields tokens, not passwords.
Remediation
- Isolate without tipping off the operator. Put the device in airplane mode only after capturing EMM state, recent logs, installed packages, device-admin list, accessibility services, and a screenshot of ransom or harassment messages if safe. If active encryption is underway, power off to halt damage; accept the forensic tradeoff and document why.
- Remove from network and identity trust. Disable VPN access, revoke enterprise Wi-Fi certificates if present, quarantine in EMM/UEM, block the device ID in Conditional Access, revoke OAuth grants, expire refresh tokens, and force reauthentication for corporate accounts.
- Preserve evidence. Export EMM compliance logs, Play Protect status, package install history, accessibility/device-admin changes, notification-listener grants, usage stats, battery/network usage, and MDM remote-action logs. For legal or extortion cases, engage counsel and DFIR before factory reset.
- Eradicate. Remove confirmed malicious packages, revoke device admin and accessibility grants, disable unknown sources, update Android and apps, run Play Protect and your mobile EDR scan, then factory reset if spyware persistence or credential capture is plausible. Restore only from backups known to predate infection; do not restore APKs or app data blindly.
- Assume account compromise. Rotate credentials reachable from the device: email, SSO, VPN, cloud storage, password manager, banking, social accounts used for recovery, and any service with SMS/notification OTP visibility. Review mailbox rules, forwarding, authenticator changes, new device enrollments, and contact-driven phishing sent after infection.
- Harden fleet policy. Enforce EMM compliance: current security patch, no unknown sources, block sideloading except approved private catalogs, block accessibility enrollment for non-approved apps, restrict notification listeners, require Play Protect, encrypt device and work profile, separate personal/work profiles, alert on device-admin changes, and use phishing-resistant MFA where possible.
- Patch and lifecycle. Keep Android OS security patch level current through OEM/carrier channels. There is no specific Mantax Otax patch in the supplied source because it is malware, not a named platform CVE; the corrective control is removal plus policy hardening. Replace end-of-life devices that no longer receive Android security updates.
- User reporting path. Give employees a one-tap route to report smishing, ransom messages, harassment, unexpected accessibility prompts, or apps requesting device admin. Speed matters: minutes after permission grant are often when data theft and session capture begin.
- Validate cloud sync integrity. If the device encrypted or deleted local files, check version history in Google Drive, OneDrive, Dropbox, NAS sync, and photo backups. Pause sync from the infected device before mass changes propagate.
- Measure the blast radius. Search for the same APK name, signer certificate, install referrer, sender number, URL, and EMM policy exceptions across the fleet. For harassment campaigns, preserve sender numbers and message bodies for carrier abuse reports and law enforcement.
Executive Takeaways
- Treat Mantax Otax-class incidents as combined mobile ransomware, spyware, and identity compromise, not as a device-only cleanup.
- The strongest preventatives are boring and effective: block sideloading, restrict accessibility and device admin, keep patch levels current, require EMM compliance, and remove SMS/notification OTP from sensitive recovery flows where feasible.
- Detection should key on sequences: off-store install → high-risk permission grant → storage churn or outbound burst. Single mobile permission events are too noisy for most SOCs.
- Build an evidence-first mobile IR runbook. Factory reset is remediation, not triage.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.