Android Ransomware Mantax Otax Encrypts Files and Streams Victim Screen in Real Time
Researchers at Zimperium have identified a new ransomware strain for Android named Mantax Otax that encrypts victim files while simultaneously recording and transmitting the device screen in real time.
The malware is distributed outside official app stores through standalone APK files hosted on file-sharing services. Links are delivered via messaging applications and phishing messages that trick users into manually installing the package.
Once active, Mantax Otax encrypts files using AES and appends the .enc extension. Ransom negotiations take place directly on the device through an on-screen chat interface displayed to the victim.
The malware records the screen as MP4 video and streams the footage to the operator while the device is in use. It also captures screenshots and uploads them to the Catbox service, and activates the camera to photograph the surrounding environment without any user notification.
Mantax Otax abuses accessibility services to read displayed content, intercepts SMS messages, and captures authentication codes sent by applications and banks. It collects contacts, call logs, and browsing history, steals credentials from WhatsApp and Telegram, and shows a fake lock screen to harvest the device PIN.
The impact depends on the Android version. On Android 9 and earlier the malware can reach all external storage. Starting with Android 10, Scoped Storage restrictions limit encryption reach, although surveillance functions continue to operate.
Language clues and files found on victims indicate a campaign aimed at Indonesia. Security recommendations include installing applications only from trusted stores, denying unnecessary accessibility, administrator, SMS, and camera permissions, and treating unsolicited APK files received via messaging with suspicion.
Related articles
Negotiating with Ransomware Attackers: Lifeline or Legal Trap?
Ransomware incidents leave organizations facing encrypted systems and threats to leak stolen data, prompting urgent questions about whether to contact extortionists. Experts emphasize that initial response must focus on containment, evidence preservation, and backup verification rather than immediate payment discussions. NCSC guidelines stress isolating affected systems, securing communication channels, and understanding the exact nature of demands before any dialogue begins. Real-world cases such as the PowerSchool breach demonstrate that paying ransoms does not ensure data deletion or end extortion attempts. Legal risks vary by jurisdiction, with prohibitions in places like North Carolina and sanctions concerns from OFAC complicating decisions for many entities. Technical recovery options, including tools from the No More Ransom project, should be evaluated alongside insurance and regulatory notification requirements under Russian Federal Law No. 152-FZ. Ultimately, successful resolution depends on verified restoration capabilities and eliminating attacker persistence rather than any negotiated discount.
Qilin Ransomware Claims at Least 365 Victims in Three Months of Attacks
The Qilin ransomware group has claimed responsibility for at least 365 organizations compromised over a three-month period, according to research published on November 11, 2026. Operating as a ransomware-as-a-service platform since September 2022, Qilin supplies the attack infrastructure while affiliates conduct intrusions and receive at least 80 percent of ransom payments. The group employs double extortion tactics, stealing sensitive data before encryption and threatening public leaks if ransoms are not paid. Its affiliate program was described as the most active worldwide during the measured timeframe. Researchers also linked the group's administrator, known as Haise, to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of Saint Petersburg, Russia, through reused online identities spanning multiple cybercrime forums and leaked records from Gosuslugi. The investigation highlighted Qilin's technical reach, including targeted attacks against VMware vCenter and ESXi environments using remote management tools, lateral movement, and vulnerable drivers to disable security products.
Ransomware Group BYOD Claims Theft of Toyota Customer Personal Data in Unverified Extortion Listing
A ransomware group calling itself BYOD has added Toyota to its victim list on a dark web extortion site, claiming to have stolen personal information belonging to the automaker’s customers. The announcement, updated on November 10, 2026, alleges access to full names, email addresses, physical addresses, telephone numbers, and dates of birth, along with data from the company’s self-service kiosk terminals. No independent verification of the claims has been performed, and the listing provides no details on the volume of records, affected regions, or specific business units involved. The group states that parts of the environment were isolated but claims residual remote access paths remained; however, the announcement contains no technical indicators or proof-of-compromise samples. Toyota has not issued any public statement confirming or denying the incident. The report notes that similar unverified listings are sometimes used to pressure victims into negotiations and may include repackaged data from prior breaches. This marks a contrast with Toyota’s 2023 public disclosure of a separate cloud misconfiguration incident that the company itself reported.
Santos Port Authority Systems Offline After Suspected Cyber Incident and Possible Ransom Demand
The systems of Autoridade Portuária de Santos (APS), which manages Brazil's largest port, have been unavailable since the morning of November 6, 2026. The outage began after a power fluctuation that affected servers and later recurred despite initial restoration efforts. APS has confirmed a suspected cyber incident but has not determined the full scope or whether data was accessed. Local reporting indicates that alleged attackers demanded financial ransom to restore operations, though this claim remains unconfirmed by APS or federal police. Backups have been sent for forensic examination while Serpro technicians assist in recovery. Port operations continue using manual procedures and heightened security measures, but vessel and truck wait times have increased significantly.