Corp MDM Android Spyware Targets Logistics Sector
Logistics companies are being targeted in a malicious campaign that distributes an Android spyware implant dubbed Corp MDM. Have I Been Squatted identified fake Google Play pages branded as CEVA and TKW Logistics that deliver an Android Package Kit file posing as a system service. The installed application uses the package name com.corp.mdm.
The implant is designed to exfiltrate newly received SMS content, divert calls and remain active through a hidden foreground service. Security researcher Ben Folland described it as a compact surveillance implant. Its feature set is narrower than that of typical commercial Android spyware, although the data it collects can still be highly sensitive.
Fake Play pages deliver a disguised Android app
The malicious packages were hosted on bogus pages including playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help. Both artifacts use the hard-coded IP address 69.55.61[.]82 for command-and-control, credential-phishing lures and delivery of additional Windows malware aimed at the logistics sector.
After an app is sideloaded, it requests permissions for SMS, telephony and notifications. These permissions allow it to intercept incoming messages, enable call forwarding and display notifications. The app then removes its ordinary launcher while preserving background execution, making its presence less visible to a user.
Thirty-second heartbeats and remote commands
Corp MDM registers an Android identifier with its command-and-control server, sends heartbeat telemetry every 30 seconds and polls for instructions. Its API endpoints include device registration, heartbeat reporting, command retrieval, command-result reporting and an SMS reporting path that transmits the sender, full message body, receipt timestamp and device identifier.
Researchers found a password-protected Corp MDM administration panel on port 3456. The panel enables an operator to issue commands such as ping, turn unconditional call forwarding on or off, initiate a nominal SMS sync action and trigger self-destruction. The panel supports location retrieval and device locking, but those capabilities are not implemented in the malware itself.
Limited SMS collection can still expose accounts
The spyware only captures inbound SMS messages received after the relevant permission is granted; it does not retrospectively steal the existing SMS inbox. Folland noted that this restriction still exposes one-time passcodes, password resets, account-recovery messages, transaction alerts and dispatch or delivery updates. The SMS fields are transmitted over cleartext HTTP.
Have I Been Squatted said the activity appears connected to a broader operation against logistics organizations involving credential phishing and Windows malware. The group behind it has not been identified, although localized panel artifacts and source-code material from the wider campaign suggest a possible Armenian or Russian nexus. Researchers also suspect artificial intelligence may have been used during development because bugs interfere with some of the implant’s capabilities.
Business implication
For logistics businesses, a mobile installation prompt can be part of a wider attempt to capture credentials, multifactor authentication codes and operational communications. Restricting sideloaded applications, reviewing SMS and telephony permissions, and moving critical access flows away from SMS where possible can reduce exposure to this type of campaign.