Zimperium Maps Mantax Otax’s Android Espionage and Extortion Chain

Key Takeaways

• DroidLock combines data theft, remote access, surveillance, backdoor functions, and device lockout in one Android package.
• Android 9 and older devices face greater exposure, while Scoped Storage limits the malware's capabilities on Android 10 and newer versions.
• Enterprises can reduce risk through controlled app distribution, permission monitoring, supported devices, and mobile threat detection.

Zimperium researchers recently detailed DroidLock, an Android malware strain that collapses several traditionally separate attack tools into a single package. The malware can steal information, monitor a device remotely, maintain backdoor access, and deploy full-screen ransom overlays and device lockout to present a ransom demand.

The campaign appears to have links to an Indonesian threat actor and is targeting victims in Indonesia. Its scale remains unclear, as does the balance between individual and business victims. Zimperium has not identified the application that DroidLock impersonates, making it harder to determine whether the operators are pursuing a particular industry or casting a wider net.

Distribution takes place outside official Android repositories. The malware is packaged as a standalone APK and may circulate through third-party stores, Telegram channels, online forums, social media, and phishing messages. Researchers found no evidence that DroidLock is available through the Google Play Store or Samsung’s Galaxy Store.

That distinction matters, but it is not a complete defense. Employees may sideload apps for work, install region-specific services, or follow links sent through familiar messaging platforms. A convincing pretext can turn Android’s installation warnings into one more screen that users tap through.

Once installed, DroidLock seeks device administrator privileges and an extensive range of permissions. These provide access to SMS messages, contacts, images, audio, and other sensitive resources. It then requests accessibility access, a particularly consequential step because Android accessibility services can let malicious applications observe screens, interact with interface elements, and exercise broad control over the device.

What can attackers collect after that? According to the research team, the list includes browser history, contacts, call records, SMS messages, notifications, files, gallery content, Google account information, location data, device specifications, and installed-application inventories. DroidLock can also extract WhatsApp messages and profile information, along with Telegram lock-screen PINs.

Its surveillance features deepen the potential business impact. Operators can capture screenshots, record the display, livestream screen activity, and take photographs through the front and rear cameras. The identified capabilities expose authentication codes, internal conversations, customer records, and information displayed in enterprise applications.

The final stage is extortion. Instead of file encryption, DroidLock deploys full-screen ransom overlays and device lockout. It then displays a chat interface through which victims can communicate with the operators and negotiate payment. This sequencing lets attackers monetize the same compromise through stolen data, account access, surveillance, and ransomware-style extortion.

Older devices carry the highest risk. On Android 9 and earlier, the malware can use its broader collection of features. Android 10 and newer releases impose Scoped Storage restrictions, limiting certain components largely to the application’s localized external-files directory. That reduces the number of user files it can reach, although it does not make reckless permission grants harmless.

The discovery fits a broader shift toward financially focused, multifunction Android malware. Kaspersky’s Mobile Threat Landscape 2025 report recorded more than 14 million blocked mobile attacks during 2025, including 815,735 malicious installation packages and 255,090 mobile banking Trojan packages. In Q1 2026, Kaspersky identified more than 306,000 malicious Android installation packages and 439 mobile ransomware Trojans.

Other researchers are seeing similar pressure. Zscaler ThreatLabz has tracked rising Android malware activity, while Malwarebytes described phones as an increasingly important attack surface amid surging Android adware during the second half of 2025. DroidLock is a more aggressive expression of that trend.

There are signs the malware remains under development. Researchers found two versions, with the newer iteration changing network behavior to use WebSockets and adding commands. For security teams, that makes static indicators less dependable over time.

Practical defenses include restricting APK sideloading, monitoring device administrator and accessibility permissions, and moving employees away from Android versions that no longer receive adequate support. Mobile device management policies can help enforce approved app sources and operating-system baselines. Mobile threat defense can add behavioral detection where platform controls fall short. Most importantly, an infected phone should be treated as a possible identity and enterprise-access incident, not merely a damaged personal device.