The ransom message is the most visible part of Mantax Otax, but it may not be the most damaging. Researchers say the Android malware can monitor a device's screen, read messages and collect other personal data while also trying to lock files and demand payment. That combination changes the response question from 'Can we restore the files?' to 'What did this phone reveal before anyone noticed?'

Zimperium's 9 September analysis describes two versions of Mantax Otax. The page provides no publication time. Some analysed samples were hosted as standalone APK files on a third-party sharing service, suggesting manual installation through a link rather than ordinary app-store delivery. The research does not establish how every infection began, how many people were affected or that the malware was distributed through Google Play. Language and recovered files point towards targets in Indonesia; they do not by themselves establish the nationality of an operator.

After installation, the app asks for device-administrator privileges and sensitive permissions, then requests Android accessibility access. If a person grants those requests, the malware can reach far beyond the files it aims to encrypt. BlackTree has documented similar abuse of Android Accessibility by ToxicPanda 2.0, though these are distinct malware families. Zimperium reports code and observed behaviour for collecting contacts, call logs, SMS messages, browser history, media and information about installed apps. It also describes interception of lock-screen PIN entry and access to messaging content through accessibility features.

Screen capture is a separate path. The malware uses Android's MediaProjection interface…