Mantax Otax: your OTP sits on an unmanaged phone

Zimperium's zLabs published research on Mantax Otax, an Android strain that bundles ransomware, spyware and live harassment into one install. The file-encryption half grabs headlines. The half that should change a policy at your company is quieter: it reads lock-screen PINs, intercepts SMS one-time passwords, and records the screen. Every account your team protects with an SMS code is protected by a phone you do not manage and cannot inspect.

What actually happened

Per Zimperium's analysis, the malware spreads by sideloading — links pushed through messaging apps, phishing and social engineering, with samples hosted on third-party file-sharing services, not Google Play. On install it asks for device administrator rights, then SMS, contacts, audio and image access, then accessibility permissions. Users who have been trained to tap through permission prompts hand over the whole device in about fifteen seconds.

What it takes: lock-screen PINs, SMS messages and OTPs, call logs, WhatsApp messages and profiles, Telegram credentials, browser history, contacts, gallery images, location, installed apps and Google account configuration. It abuses the MediaProjection API for real-time screen recording and silently triggers the front and rear cameras.

The ransomware component pulls a victim-specific AES key from its command-and-control server, keyed to the device's Android ID, and appends .enc. Scope depends heavily on OS version: on Android 9 and earlier it recursively walks shared external storage; on Android 10 and later, Scoped Storage confines it largely to the app's own external files directory, sharply limiting the damage. Version 2 moved to WebSocket C2, resolves its active domain from GitHub repositories, and exfiltrates through Firebase and Catbox. Harassment features include dialog spam, full-screen video overlays, screen blocking and jumpscare popups spawned every 600 milliseconds. Zimperium's language indicators point at Indonesian targets.

Why mobile OTP theft matters for your business

You are probably not in the target set. That is not the point. The capability set here is commodity now, and the architecture lesson is universal: SMS and app-displayed OTPs are only as strong as the endpoint rendering them, and for most small businesses that endpoint is an employee's personal phone with sideloading enabled and no MDM.

Three concrete moves, in order of payoff.

Kill SMS as a second factor where you still have it — payroll, banking, your domain registrar, the email tenant. Registrar and DNS first, because whoever owns those owns everything downstream. Move to passkeys or a hardware key (FIDO2), which do not produce a code that can be read off a screen and cannot be replayed by an attacker watching a MediaProjection stream.

Then check OS versions. The Android 9-or-earlier distinction in this report is not trivia — it is the difference between losing a gallery folder and losing the device. Any phone that touches company email and cannot run Android 10+ should be replaced, and that is a hardware cost you can put a number on.

Finally, write down what happens when a phone is compromised. Not a policy document — a list. Which sessions get revoked, which passwords rotate, who has the authority to do it at 9pm on a Saturday. Most companies discover they have no answer during the incident.

Sources: Zimperium zLabs, BleepingComputer.