The logistics sector is currently under siege by a new malicious cyber campaign deploying **Corp MDM**, an Android spyware. This operation leverages convincing fake Google Play pages, branded with names like **CEVA** and **TKW Logistics**, to trick users into downloading a malicious Android Package Kit (APK) file disguised as a system service. ### Corp MDM's Capabilities and Design Security researcher **Ben Folland** from **Have I Been Squatted** describes **Corp MDM** as a "compact surveillance implant." Its primary functions include exfiltrating newly received SMS content, diverting calls, and maintaining a hidden foreground service. Notably, the malware is described as narrow in its design, lacking the extensive feature sets typically found in commercial Android spyware. Intriguingly, researchers suspect the use of artificial intelligence (AI) in the development phase due to the presence of bugs that hinder some of its intended capabilities. ### Broader Campaign and Distribution Tactics This Android spyware campaign is believed to be part of a larger, multi-pronged attack targeting the logistics sector. This broader effort also incorporates credential phishing and Windows-based malware. The malicious APKs are distributed via bogus Google Play Store pages, such as: * `playgoogle.logisticstkwcargo[.]com` * `playgoogle.ceva-app[.]help` Both artifacts utilize a hard-coded IP address (`69.55.61[.]82`) for their command-and-control (C2) infrastructure. This same infrastructure is also used to host credential-phishing lures and serve additional Windows malware aimed at the logistics industry. ### Infection Chain and Data Exfiltration Upon successful sideloading and installation, the malicious application requests critical permissions, including SMS, telephony, and notification access. These permissions enable it to intercept incoming SMS messages, activate call forwarding, and display notifications. The malware also removes its normal launcher icon to evade detection and ensures continuous background execution. The infection proceeds through several stages, involving communication with the C2 server: * `/api/v1/devices/register`: Registers the infected device with basic information. * `/api/v1/devices/heartbeat`: Sends heartbeat telemetry every 30 seconds. * `/api/v1/devices/{ANDROID_ID}/commands`: Polls for commands issued by the threat actor. * `/api/v1/commands/result`: Posts the results of executed commands. * `/api/v1/sms/report`: Transmits SMS sender, message body, and received timestamp, along with the device identifier. ### Attacker Control and Command Structure The attacker-controlled infrastructure hosts a password-protected **Corp MDM** admin panel on port 3456. This panel allows operators to manage infected devices and issue commands. Supported commands include: * `ping`: Returns "pong" via the command-result endpoint. * `forward_on`: Issues an unconditional call-forwarding code with an operator-selected number. * `forward_off`: Requests cancellation of unconditional forwarding using `##21#`. * `sync_sms`: Reports the initiation of the sync process without actual data collection. * `self_destroy`: Disables implant components, stops the service, and requests app-data clearing. * `get_location` and `lock_device`: Supported by the panel but not yet implemented in the malware. It's important to note that **Corp MDM**'s SMS stealing functionality is limited to new inbound messages received *after* permissions are granted; it does not exfiltrate historical SMS inbox contents. Despite this limitation, **Folland** emphasizes that "SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP." ### Attributed Origins and Broader Context The identity of the threat actor behind this operation remains unconfirmed. However, **Have I Been Squatted** suggests a potential Armenian or Russian nexus, citing localized artifacts within the admin panel's user interface and source code associated with the wider campaign. The logistics sector has been a recurring target for cybercriminals. In November 2025, **Proofpoint** detailed a campaign that infected trucking and logistics companies with remote monitoring and management (RMM) software for financial gain and cargo theft. More recently, in February, **Ctrl-Alt-Intel** and **Have I Been Squatted** exposed **Diesel Vortex**, a threat cluster targeting freight and logistics entities in the U.S. and Europe, including major players like **DAT Truckstop**, **TIMOCOM**, **Teleroute**, **Penske Logistics**, **Girteka**, and **Electronic Funds Source (EFS)**. Furthermore, a Russian-Armenian threat actor is reportedly behind **Global Profit** (also known as **MC Profit Always**), a phishing-as-a-service (PhaaS) platform specifically designed to target the freight and logistics sector. This platform has been used to steal over 1,600 unique login credentials between September 2025 and February 2026. **Have I Been Squatted** concluded, "This operation was not the work of a lone actor. It was a structured, financially driven criminal service sold to other operators, with evidence suggesting the group was actively employing spear-phishing and voice phishing techniques, specifically targeting trucking and logistics Telegram groups." Through the impersonation of legitimate platforms, attackers have intercepted logins, multi-factor authentication codes, shipment information (via invoice redirection and double-brokering), personal details, and funds.