[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftcQ6mxo2ElYPEgKPOu3pm6uBZ88QqgsX_Q4aeaUl5QI":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"75660aa8-23c7-44df-b0d1-ceab7ffed755","New Android malware encrypts files, steals data, and harasses victims","new-android-malware-encrypts-files-steals-data-and-harasses-victims-b8fb16","A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. [...]","A new Android malware strain, Mantax Otax, has been identified that combines ransomware and spyware capabilities. Distributed via malicious APKs outside of Google Play, it targets older Android versions (9 and below) by encrypting files and demanding ransom. It also steals sensitive data, captures screenshots, records video, and harasses victims with intrusive pop-ups and audio messages.","New Android malware Mantax Otax combines ransomware and spyware, encrypting files and stealing data.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-android-malware-encrypts-files-steals-data-and-harasses-victims\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F03\u002F10\u002Fandroid.jpg","2026-09-10T21:40:43+00:00","2026-09-10T22:00:24.2567+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Android","product",{"name":24,"type":25},"Accessibility service","technology",{"name":27,"type":25},"Firebase",{"name":29,"type":25},"WebSockets",{"name":31,"type":25},"MediaProjection API","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":36,"value":52,"context":53},"Mantax Otax","Name of the new Android malware strain",[18,21],{"controls":56,"vendors":133},[57,86,104],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[91,96],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":92,"product_name":93,"url":94,"description":95},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":105,"name":106,"problem":107,"products":108},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":150},"android-malware-combines-ransomware-spyware-via-sideloaded-apks","Android Malware Combines Ransomware & Spyware via Sideloaded APKs","The Mantax Otax malware exploits a combination of user behavior and unpatched software by targeting Android devices running version 9 or older through malicious APKs distributed outside the official Google Play Store. The root problem is twofold: users are sideloading untrusted applications, and outdated Android versions lack modern security mitigations. This hybrid threat is particularly dangerous because it simultaneously encrypts files for ransom, exfiltrates sensitive data, and conducts active surveillance — meaning victims face financial, privacy, and psychological harm. Organizations and individuals who fail to keep mobile devices updated or restrict app sources create easy entry points for sophisticated mobile threats.",[139,140,141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices","NIST SI-3: Malicious Code Protection","NIST CM-7: Least Functionality (restrict unauthorized app installation)","NIST AC-19: Access Control for Mobile Devices","GDPR Article 32: Security of Processing (protection of personal data on mobile devices)","GDPR Article 25: Data Protection by Design and by Default","ITIL: Change Management \u002F Patch Management practices for endpoint devices",{}]