On September 9, Zimperium's zLabs team published a technical writeup on MantaxOtax, an Android family that pairs file-encrypting ransomware with a full surveillance stack. Infosecurity Magazine covered it the following day. It targets users in Indonesia, arrives as a sideloaded APK from a third-party file host, and — the detail that stopped me — abuses Android's MediaProjection API for screenshots, MP4 screen recording and near-real-time streaming, staging the captures on the free file host Catbox and mailing the links back to its operators. It can also take silent photos on either camera.
I build a background camera app. I want to be precise about why that paragraph is uncomfortable rather than vindicating.
There is no exploit in the capture path
Read the Zimperium writeup looking for the clever bit and you won't find one, at least not in the recording. MediaProjection is the documented, supported way an Android app captures the screen — it's what every screen recorder and every screen-sharing app on your phone uses. Camera access is camera access. The malware's capture stack is not a vulnerability chain. It is the platform working as designed, pointed somewhere you didn't intend.
The actual craft is elsewhere, and it's mundane: convince someone to sideload the APK, then walk them through granting device administrator, then SMS, contacts, audio and images, and finally Accessibility — which, once granted, gives an app broad reach over the device's own interface. Zimperium also describes the C2 domain being resolved from a GitHub repository so operators can rotate infrastructure without shipping new code, and a Firebase misconfiguration that left some of the extortion chats exposed. Clever operationally. Not clever at the camera.
Two other details from the writeup are worth carrying, because they cut against the usual "malware is unstoppable" framing. On Android 10 and later, Scoped Storage confined the encryption routine to the app's own external files directory, sharply reducing what it could reach — a platform change, made years ago for unrelated reasons, blunting a ransomware payload. And the whole thing depends on sideloading plus a permission ladder that the user climbs manually.
So "it can record with the screen off" tells you nothing
Here is the uncomfortable part for anyone in my category.
If you tried to identify malicious software by asking can this app capture without an obvious on-screen sign, you would flag MantaxOtax. You would also flag Background Camera RemoteStream, which is our whole product. Recording with the screen off is not an exotic capability we reverse-engineered; it's a thing Android lets a foreground-service app do, and a dozen legitimate apps — dashcams, baby monitors, trail cameras, screen recorders — do it because the use case requires it. A screen that is off is not an app that is idle. That's true of the malware and it is equally true of us.
Which means capability is not a signal. Both sides of this comparison have the same capability. The distinguishing facts are somewhere else, and the useful thing I can offer here is where.
The questions that actually discriminate
Where do the bytes go? MantaxOtax's answer is Catbox and a rotating C2. That is the load-bearing fact about it — not that it recorded, but that the recording left. For any capture app on your phone, the honest version of the privacy question is not "does it record" but "does it have anywhere to send it, and can you tell." An app whose recordings are written to local storage and never uploaded has a materially different failure mode from one that ships to a server, and you can test the difference: put the device in airplane mode and see whether the feature still works.
What is it asking for, and does the ask match the job? A camera app needs the camera. It does not need Accessibility, and it does not need device administrator. Accessibility in particular is the permission that turns a nuisance into a takeover, and it is the one that should make you stop. Android's permission manager (Settings → Privacy → Permission manager, and the separate Accessibility and Device admin screens) will list every app currently holding these. Most people have never opened those screens. It's worth ten minutes.
Where did it come from? Sideloading is how this particular family arrives. That is not an argument that store distribution is a safety guarantee — plenty of unpleasant things have shipped through official stores, and plenty of excellent, genuinely private software is distributed outside them. F-Droid exists and is not a red flag. But an APK handed to you over a messaging app by someone creating urgency is a different object from a package you went and found.
What does the platform say? Android 12 and later show an indicator in the status bar when the camera or microphone is in use, and the quick-settings panel will name the app. It is not a complete defense, but it is a signal the app doesn't author, and it costs nothing to glance at.
Where we actually sit
Background Camera RemoteStream stores recordings locally, requires no account, and doesn't run analytics or tracking. I want to be careful about how much credit that deserves. "No cloud" is closer to table stakes than a differentiator — there is a healthy set of local-first and open-source Android camera projects making the same commitment, some of them more auditable than us because you can read their source. If your threat model is "I want to verify, not trust," an app you can compile yourself has an argument we can't match, and that's a fair thing for a reader to weigh.
What I'd rather claim is narrower and I think it's true: the difference between our screen-off recording and the screen capture in Zimperium's report is not technical sophistication and it is not capability. It's who initiated the capture, where the output lives, and how much of the device the thing can reach when it goes wrong. A recorder that holds camera and storage permissions and writes to local storage has a bounded blast radius. Something holding Accessibility and device admin does not, and the recording is the least of what you lost.
That framing is less flattering to us than "malware records you, buy our app." It's also the only version that survives contact with the Zimperium writeup, which is right there and which you should read.
Background Camera RemoteStream — local storage, no account required, no tracking, screen-off recording and YouTube Live streaming.
Google Play: https://play.google.com/store/apps/details?id=com.superfunicular.digicam
Site: https://superfunicular.com
Sources: Zimperium zLabs technical writeup, Sept 9, 2026 · Infosecurity Magazine, Sept 10, 2026
Top comments (0)