Android Spyware Corp MDM Hits Logistics via Fake Play Pages
An Android spyware implant named Corp MDM is being distributed to logistics companies through fake Google Play store pages that impersonate CEVA and TKW Logistics, according to research published by Have I Been Squatted. The delivered Android Package Kit (APK) file is disguised as a system service and carries the package name com.corp.mdm. Security researcher Ben Folland described the implant as a compact surveillance tool built to take newly received SMS messages, divert calls, and keep a hidden foreground service running.
The malware is narrow by design, lacking many spyware functions usually seen in commercial Android spyware. The researchers suspect the developer may have used artificial intelligence during development because bugs in the code interfere with some of its capabilities. The campaign uses bogus Google Play pages hosted at playgoogle.logisticstkwcargo.com and playgoogle.ceva-app.help. Both malicious packages connect to a hard-coded IP address, 69.55.61.82, which serves as the command-and-control (C2) server and also hosts credential-phishing lures and additional Windows malware aimed at the logistics sector.
Once the app is installed from outside the official store, it requests SMS, telephony, and notification permissions. With those permissions the implant can intercept incoming SMS messages, enable call forwarding, and display notifications. It also removes its normal launcher while continuing to run in the background. After installation, it registers an Android identifier with the C2 server, sends a heartbeat every 30 seconds, and repeatedly polls for commands. The malware calls server endpoints such as /api/v1/devices/register, /api/v1/devices/heartbeat, /api/v1/devices/{ANDROID_ID}/commands, /api/v1/commands/result, and /api/v1/sms/report.
The attacker-controlled infrastructure hosts a password-protected Corp MDM admin panel on port 3456. From that panel an operator can send commands to infected devices. Supported commands include ping, forward_on to set unconditional call forwarding to a number the operator chooses, forward_off to cancel unconditional forwarding with the code ##21#, sync_sms to report that a sync has started without actually collecting data, and self_destroy to disable the implant components, stop the service, and request that app data be cleared. Two commands shown in the panel, get_location and lock_device, are not supported by the malware itself.
The SMS stealing function only captures new inbound messages after permission is granted; it does not go back and steal messages already stored on the phone. Ben Folland noted that this limited collection path is still enough to expose high-value content because SMS is still common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full message body, and timestamp all leave the device over unencrypted HTTP.
It is not yet clear who runs the operation. Have I Been Squatted said the activity likely has an Armenian or Russian connection, pointing to localized text in the panel user interface and source code tied to the wider campaign. The same research describes the fake Google Play pages as part of a broader operation against the logistics sector that also uses credential phishing and Windows-based malware.
The logistics industry has faced repeated attacks. In November 2025 Proofpoint detailed a campaign that infected trucking and logistics companies with remote monitoring and management (RMM) software for financial gain and cargo theft. Earlier this February, Ctrl-Alt-Intel and Have I Been Squatted reported on a threat cluster called Diesel Vortex that targeted freight and logistics entities in the U.S. and Europe, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS). A Russian-Armenian threat actor behind a phishing-as-a-service platform named Global Profit, also known as MC Profit Always, stole more than 1,600 unique login credentials between September 2025 and February 2026 by targeting freight and logistics workers through bogus emails, spear-phishing, and voice phishing in trucking and logistics Telegram groups. Have I Been Squatted said that operation was not the work of a lone actor but a structured, financially driven criminal service sold to other operators, which intercepted logins and multi-factor authentication codes in real time and then used invoice redirection and double-brokering to gain shipment information, personal details, and steal funds.
For readers who run websites, online stores, or IT operations, a single compromised staff phone can expose customer accounts, shipment details, and login codes. AEU-I offers security-first IT, infrastructure and consulting, which can help businesses assess and tighten the systems and devices their staff rely on.