New Android Malware Mantax Otax Combines Ransomware and Spyware Capabilities

A new Android malware strain called Mantax Otax has been identified by security researchers, combining ransomware and spyware capabilities to target Android devices globally. The threat actor operation, attributed to unknown threat actors, delivers a hybrid payload that encrypts user files, exfiltrates sensitive data, and engages in harassment through spam campaigns. The malware was first reported on 2026-09-10 and has since been observed in active exploitation. Victims experience file encryption typical of ransomware, while their personal and corporate data is silently exfiltrated. Additionally, the malware spams contacts or displays intrusive messages to harass victims. As of now, no official patch or remedy has been released by the malware's operators. Security experts recommend that Android users update their operating systems to the latest version and avoid sideloading applications from untrusted sources to reduce the risk of infection. The full scope of the impact, including exact distribution vectors, ransom demands, and victim counts, remains unconfirmed and requires further investigation.