Loading malware…
TERRACOTTA is an Android malware family observed with mobile surveillance and fraud-enabling capabilities. It can enumerate installed applications, collect device and subscriber-related information such as the phone number and network characteristics, and abuse Android broadcast receivers to trigger functionality in response to system events, supporting persistence and event-driven execution. TERRACOTTA has also been associated with deceptive post-installation forms used to solicit user data, indicating credential or sensitive-data collection through malicious prompts. In addition, it can send SMS messages, a capability commonly used in mobile malware for message abuse, fraud, propagation, or interference with SMS-based verification workflows. The malware targets Android devices and exhibits behavior consistent with post-compromise device profiling, persistence, and user-data theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Monokle checks if the device is connected via Wi-Fi or mobile data; Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming; TianySpy can check to see if Wi‑Fi is enabled; TERRACOTTA can check if the active network connection is metered; TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi‑Fi connection state.
AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware that displays forms after installation to collect user data.
Android malware capable of obtaining a list of installed applications.
Android malware that registers multiple broadcast receivers to trigger behavior from system or app events.
Android malware with SMS-sending capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.