The logistics sector has become the target of a new malicious campaign, and this one distributes an Android spyware codenamed Corp MDM, which is a compact surveillance implant designed to steal SMS messages, divert calls, and stay hidden in the background.

According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics, and these pages push an Android Package Kit dressed up as a system service, with the package name com.corp.mdm, so the app looks legitimate at a glance.

Researcher Ben Folland described Corp MDM as narrow by design, and it lacks the spyware functions you would normally see in commercial Android spyware, which is interesting, because the bugs that interfere with its own capabilities suggest the threat actor may have used AI during development.

The activity is also part of a broader campaign targeting logistics, because the same infrastructure hosts credential phishing pages and Windows-based malware, so the Android spyware is one piece of a larger operation.

Quick Summary

How It Spreads

The malicious packages are distributed through bogus Google Play Store pages, including playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help, so the attacker is impersonating real logistics brands to make the download look trustworthy.

Both artifacts use a hard-coded IP address for command-and-control, and that same IP also hosts credential-phishing lures and serves additional Windows malware targeting the logistics sector, which means one server is doing a lot of work for the campaign.

Once the app is sideloaded and installed, it requests SMS, telephony, and notification permissions, which lets it intercept incoming messages, enable call forwarding, and display notifications, and it also removes its normal launcher icon while ensuring it keeps running in the background.

So the app hides itself from the user's home screen, keeps itself alive, and starts talking to the C2 server without any visible sign.

What It Does After Installation

In the next stage, the malware registers an Android identifier with the C2 server, sends heartbeat telemetry every 30 seconds, and polls for commands repeatedly, and the endpoints it uses include register, heartbeat, commands, command result, and SMS report.

The SMS report endpoint is the one that matters most, because it transmits the sender, the message body, and the received timestamp along with the device identifier, so every new text message goes straight to the attacker.

The attacker-controlled infrastructure also hosts a password-protected Corp MDM admin panel on port 3456, which allows the operator to commandeer infected devices and send commands, and the supported commands include ping, forward_on, forward_off, sync_sms, self_destroy, get_location, and lock_device.

Notably, get_location and lock_device are supported by the panel but not by the malware itself, which suggests the panel is more capable than the implant, and that the implant may be an earlier or narrower build.

The SMS Theft Is Limited but Still Dangerous

Corp MDM's SMS stealing functionality is limited to new inbound messages after the permission is granted, so it does not retroactively exfiltrate the existing SMS inbox, which is a limitation, but it is still enough to cause serious harm.

Folland said that limited collection path is sufficient to expose high-value content, because SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates, and the sender, full body, and timestamp all leave the device over cleartext HTTP.

So even a narrow implant can intercept the codes that protect accounts, and that is exactly what makes this campaign worth paying attention to.

Who Is Behind It

It is currently unclear who is behind the operation, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign.

That attribution is not definitive, but it fits a pattern, because the logistics sector has been targeted repeatedly, and in November 2025, Proofpoint detailed a campaign that infected trucking and logistics companies with remote monitoring and management software for financial gain and cargo theft.

Earlier this February, Ctrl-Alt-Intel and Have I Been Squatted shed light on a threat cluster codenamed Diesel Vortex that singled out freight and logistics entities in the U.S. and Europe, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source.

And a Russian-Armenian threat actor is behind a phishing-as-a-service platform codenamed Global Profit, which is specifically designed to target freight and logistics, and it stole over 1,600 unique login credentials between September 2025 and February 2026.

Have I Been Squatted said that operation was not the work of a lone actor, but a structured, financially driven criminal service sold to other operators, with evidence suggesting the group actively employed spear-phishing and voice phishing techniques targeting trucking and logistics Telegram groups.

Through impersonation of legitimate platforms, operators intercepted logins and multi-factor authentication codes in real time, and went on to intercept shipment information, access personal details, and steal funds.

So the logistics sector is not just a target, it is a market, and there are criminal services built specifically to exploit it.

What You Should Do

• Avoid sideloading apps from outside official app stores, especially from pages that mimic Google Play but use unusual domains.
• Check app permissions carefully, and be suspicious of any app that requests SMS, telephony, and notification access together.
• Watch for apps that disappear from the launcher after installation, because that is a sign the app is hiding itself.
• Monitor network traffic for cleartext HTTP requests to suspicious IPs, especially if they include SMS content.
• Review devices for the package name com.corp.mdm, and remove it if found.
• Train staff to recognize fake app store pages and phishing lures, because the logistics sector is being actively targeted.
• If you suspect infection, isolate the device, preserve logs, and rotate any credentials that may have been exposed through SMS.

The Bottom Line

Corp MDM is a narrow Android spyware that targets the logistics sector through fake Google Play pages, and while its SMS theft is limited to new messages, that is enough to intercept one-time passcodes and account recovery codes, and the campaign is part of a broader operation that also uses credential phishing and Windows malware, so the logistics sector needs to treat this as a sustained threat rather than a one-off.

Quick Reference

What to Do

• Avoid sideloading from unofficial sources
• Check app permissions carefully
• Watch for apps that hide from the launcher
• Monitor for cleartext SMS exfiltration
• Remove com.corp.mdm if found
• Train staff on fake app store pages
• Isolate and rotate if infected

FAQ Section

What is Corp MDM?

It is an Android spyware designed to steal SMS messages, divert calls, and maintain a hidden foreground service, and it is distributed through fake Google Play pages impersonating CEVA and TKW Logistics.

How does it spread?

Through bogus Google Play Store pages that push an APK dressed up as a system service, with the package name com.corp.mdm, and the same infrastructure also hosts credential phishing and Windows malware.

What can it do?

It requests SMS, telephony, and notification permissions, intercepts new inbound SMS messages, enables call forwarding, hides its launcher icon, and communicates with a C2 server using a hard-coded IP.

Does it steal old text messages?

No, it only exfiltrates new inbound messages after the permission is granted, so it does not retroactively collect the existing inbox.

Who is behind it?

It is unclear, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, based on localized artifacts in the panel and source code.

What should I do if I find it?

Remove the app, isolate the device, preserve logs, and rotate any credentials that may have been exposed through SMS, and report the incident to your security team.

Source: The Hacker News