Ethical Hacking News
Corp MDM Spyware: A Malicious Campaign Targeting Logistics Firms and Stealing New SMS
A new malicious campaign has been detected that targets logistics firms and steals new SMS content using an Android spyware codenamed Corp MDM. The malware is designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service. This is not the first time threat actors have targeted the logistics sector, with previous campaigns using credential phishing and Windows-based malware. The attack is believed to have an Armenian or Russian nexus, and it's unclear who is behind the operation. This article provides a detailed explanation of the Corp MDM spyware and its tactics, as well as the broader context of the logistics sector's vulnerability to cyber attacks.
The logistics sector is targeted by a new malicious cyber campaign distributing an Android spyware codenamed Corp MDM. The malware uses fake Google Play pages and is designed to exfiltrate SMS content, divert calls, and maintain a hidden foreground service. The threat actor is suspected to have used artificial intelligence during development, resulting in bugs that interfere with its capabilities. The malware is distributed via bogus Google Play Store pages and requests SMS, telephony, and notification permissions. The malware-laced app removes its normal launcher and ensures background execution. The attacker-controlled infrastructure hosts a password-protected Corp MDM admin panel that allows the operator to commandeer infected devices and send commands. The malware's SMS stealing functionality is limited to new inbound messages after permission is granted. The activity is likely linked to an Armenian or Russian nexus, citing localized artifacts and source code. The logistics sector has been targeted by multiple malicious campaigns in recent times, including a campaign using remote monitoring and management (RMM) software and a phishing-as-a-service (PhaaS) platform.
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. This campaign, which has been identified by security researchers, uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm". Corp MDM is a "compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service", security researcher Ben Folland said.
The malware has been described as narrow by design, lacking in spyware functions typically observed in commercial Android spyware. It's suspected that the threat actor behind the campaign used artificial intelligence (AI) during the development phase, given the presence of bugs that interfere with its capabilities. In addition, the activity is said to be part of a broader campaign targeting the logistics sector using credential phishing and Windows-based malware.
The malicious packages are distributed via bogus Google Play Store pages such as below - playgoogle.logisticstkwcargo[.]com, playgoogle.ceva-app[.]help. Both the artifacts use a hard-coded IP address ("69.55.61[.]82") for command-and-control (C2), as well as for hosting credential-phishing lures and serving additional Windows malware targeting the logistics sector.
Once sideloaded and installed, the malicious app requests SMS, telephony, and notification permissions, allowing it to intercept incoming SMS messages, enable call forwarding, and display notifications. The malware-laced app also removes its normal launcher, while ensuring background execution.
In the next stage, it registers an Android identifier with the C2 server, sends heartbeat telemetry every 30 seconds, and repeatedly polls for commands every seconds - /api/v1/devices/register, to register the device, along with basic information /api/v1/devices/heartbeat, to send heartbeat message /api/v1/devices/{ANDROID_ID}/commands, to receive commands issued by the threat actor /api/v1/commands/result, to post the results of the command execution /api/v1/sms/report, to transmit SMS sender, message body, and received timestamp, along with the device identifier.
The attacker-controlled infrastructure has been found to host a password-protected Corp MDM admin panel on port 3456 that allows the operator to commandeer infected devices and send commands. The list of supported commands is as follows - ping, to return "pong" through the command-result endpoint, forward_on, to issue unconditional call-forwarding code with an operator-selected number, forward_off, to request cancellation of unconditional forwarding with ##21#, sync_sms, to report the initiation of the sync process without performing data collection, self_destroy, to disable the implant components, stop the service, and request app-data clearing, get_location (supported by the panel, but not by the malware), lock_device (supported by the panel, but not by the malware).
Corp MDM's SMS stealing functionality is limited to new inbound messages after the permission is granted. It does not retroactively exfiltrate the SMS inbox contents. That limited collection path is sufficient to expose high-value content, Folland said. "SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP."
It's currently unclear who is behind the operation, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign.
This is not the first time threat actors have gone after the logistics sector. In November 2025, Proofpoint detailed a campaign that infected trucking and logistics companies with remote monitoring and management (RMM) software for financial gain and cargo theft. Earlier this February, Ctrl-Alt-Intel and Have I Been Squatted shed light on a threat cluster codenamed Diesel Vortex that singled out freight and logistics entities in the U.S. and Europe, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS).
A Russian-Armenian threat actor is behind a new phishing-as-a-service (PhaaS) platform codenamed Global Profit (aka MC Profit Always) that's specifically designed to target the freight and logistics sector via bogus emails and steal over 1,600 unique login credentials between September 2025 and February 2026.
This operation was not the work of a lone actor, Have I Been Squatted said. "It was a structured, financially driven criminal service sold to other operators, with evidence suggesting the group was actively employing spear-phishing and voice phishing techniques, specifically targeting trucking and logistics Telegram groups." "Through the impersonation of the legitimate platforms that their targets would be using daily, operators intercepted logins and multi-factor authentication codes in real time, and went on to intercept shipment information (via invoice redirection and double-brokering), access personal details, and steal funds."
Related Information:
https://www.ethicalhackingnews.com/articles/Corp-MDM-Spyware-A-Malicious-Campaign-Targeting-Logistics-Firms-and-Stealing-New-SMS-ehn.shtml
https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
Published: Thu Sep 24 09:27:20 2026 by llama3.2 3B Q4_K_M
