New Android malware discovered that can steal OTPs, spy on WhatsApp

A new Android malware, reportedly called Mantax Otax, is raising concerns due to its wide range of malicious capabilities. It can allegedly steal OTPs, spy on WhatsApp and Telegram activity, encrypt files on older Android devices, and even harass victims with disturbing pop-ups, jumpscares, and creepy audio. The malware is reportedly distributed through malicious APK files from sources outside the Google Play Store. Android users should therefore exercise extreme caution and avoid installing APKs from untrusted or unknown sources.

The Mantax Otax combines ransomware, spyware and remote-control capabilities, giving attackers several ways to take control of an infected phone. The malware was discovered by mobile security firm Zimperium.

Researchers found samples of Mantax Otax being distributed as malicious APK files hosted on third-party file-sharing platforms rather than Google Play. The malware was also found being spread through phishing links, messaging platforms and social-engineering campaigns, where users are tricked into downloading and installing the app.

Once installed, Mantax Otax asks for powerful permissions, including Accessibility access and device administrator privileges. With these permissions, the malware can reportedly interact with the device and carry out actions on the victim's behalf. It then connects to infrastructure controlled by the attackers and registers the infected device, sending back details such as its Android version, location and other device information. In simpler terms, the malware can hack the victims and perform actions without the user's knowledge.

The spyware side of Mantax Otax is particularly concerning. According to the researchers, the malware can read SMS notifications, including messages containing one-time passwords (OTPs), as well as collect call logs, contacts, browser history, installed apps, location information and Google account details.