Mantax Otax Android Malware Makes OTP Device Hygiene More Urgent

BleepingComputer reported on September 11, 2026 that researchers are tracking a new Android malware family called Mantax Otax. The malware is described as capable of stealing data, encrypting files, and pressuring victims after infection, which makes it more than a simple nuisance app.

For everyday users, the lesson is familiar but still important: the device that receives one-time passwords, passkeys, account alerts, and recovery messages is part of the security boundary. If that phone becomes infected, account protection can weaken even when the account password itself has not changed.

Why it matters for verification

Many verification journeys still depend on mobile devices. A compromised phone can expose messages, session notifications, contacts, and recovery prompts. That can create confusion during account checks and make it easier for attackers to pressure a user into approving something they did not request.

BillioPlus checklist

• Install Android apps only from trusted stores and avoid sideloaded APKs from message links.
• Keep OTP and recovery devices updated before using them for sensitive account activity.
• Review accessibility, notification, SMS, and file permissions for apps that do not clearly need them.
• Move account recovery away from any device that shows signs of malware, pop-ups, or unusual file behavior.

Source links

BleepingComputer: Mantax Otax Android malware report