Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls

A new Android spyware campaign codenamed Corp MDM is targeting the logistics sector through fake Google Play pages branded as CEVA and TKW Logistics, distributing an APK named "com.corp.mdm" that exfiltrates newly received SMS content, diverts calls, and maintains a hidden foreground service, according to Have I Been Squatted. Security researcher Ben Folland said the implant registers with a hard-coded command-and-control IP address (69.55.61[.]82), sends heartbeat telemetry every 30 seconds, and polls for commands including forward_on, sync_sms, and self_destroy, while its SMS theft is limited to new inbound messages after permission is granted. Have I Been Squatted said the activity likely has an Armenian or Russian nexus and is part of a broader logistics-sector campaign using credential phishing and Windows-based malware, with the threat actor suspected of using artificial intelligence during development given bugs that interfere with the malware's capabilities.

The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM . According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit APK file that’s dressed up as a system service. The delivered app has the package name “com.corp.mdm” Corp MDM is a “compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service,” security researcher Ben Folland said https://haveibeensquatted.com/blog/inside-corp-mdm-android-spyware-targeting-logisitics . The malware has been described as narrow by design, lacking in spyware functions typically observed in commercial Android spyware. It’s suspected that the threat actor behind the campaign used artificial intelligence AI during the development phase, given the presence of bugs that interfere with its capabilities. In addition, the activity is said to be part of a broader campaign targeting the logistics sector using credential phishing and Windows-based malware. The malicious packages are distributed via bogus Google Play Store pages such as below – - playgoogle.logisticstkwcargo . com - playgoogle.ceva-app . help Both the artifacts use a hard-coded IP address “69.55.61 . 82” for command-and-control C2 , as well as for hosting credential-phishing lures and serving additional Windows malware targeting the logistics sector. Once sideloaded and installed, the malicious app requests SMS, telephony, and notification permissions, allowing it to intercept incoming SMS messages, enable call forwarding, and display notifications. The malware-laced app also removes its normal launcher, while ensuring background execution. In the next stage, it registers an Android identifier with the C2 server, sends heartbeat telemetry every 30 seconds, and repeatedly polls for commands every seconds – - /api/v1/devices/register, to register the device, along with basic information - /api/v1/devices/heartbeat, to send heartbeat message - /api/v1/devices/{ANDROID ID}/commands, to receive commands issued by the threat actor - /api/v1/commands/result, to post the results of the command execution - /api/v1/sms/report, to transmit SMS sender, message body, and received timestamp, along with the device identifier The attacker-controlled infrastructure has been found to host a password-protected Corp MDM admin panel on port 3456 that allows the operator to commandeer infected devices and send commands. The list of supported commands is as follows – - ping, to return “pong” through the command-result endpoint - forward on, to issue unconditional call-forwarding code with an operator-selected number - forward off, to request cancellation of unconditional forwarding with 21 . - sync sms, to report the initiation of the sync process without performing data collection - self destroy, to disable the implant components, stop the service, and request app-data clearing - get location supported by the panel, but not by the malware - lock device supported by the panel, but not by the malware Notably, Corp MDM’s SMS stealing functionality is limited to new inbound messages after the permission is granted. It does not retroactively exfiltrate the SMS inbox contents. “That limited collection path is sufficient to expose high-value content,” Folland said. “SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP.” It’s currently unclear who is behind the operation, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign. This is not the first time threat actors have gone after the logistics sector. In November 2025, Proofpoint detailed https://thehackernews.com/2025/11/cybercriminals-exploit-remote.html a campaign that infected trucking and logistics companies with remote monitoring and management RMM software for financial gain and cargo theft. Earlier this February, Ctrl-Alt-Intel https://ctrlaltintel.com/research/DieselVortex/ and Have I Been Squatted https://haveibeensquatted.com/blog/diesel-vortex-inside-the-russian-cybercrime-group-targeting-us-eu-freight shed light on a threat cluster codenamed Diesel Vortex that singled out freight and logistics entities in the U.S. and Europe, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source EFS . A Russian-Armenian threat actor is behind a new phishing-as-a-service PhaaS platform codenamed Global Profit aka MC Profit Always that’s specifically designed to target the freight and logistics sector via bogus emails and steal over 1,600 unique login credentials between September 2025 and February 2026. “This operation was not the work of a lone actor,” Have I Been Squatted said. “It was a structured, financially driven criminal service sold to other operators, with evidence suggesting the group was actively employing spear-phishing and voice phishing techniques, specifically targeting trucking and logistics Telegram groups.” “Through the impersonation of the legitimate platforms that their targets would be using daily, operators intercepted logins and multi-factor authentication codes in real time, and went on to intercept shipment information via invoice redirection and double‑brokering , access personal details, and steal funds.”