Corp MDM reaches logistics staff phones through fake CEVA and TKW Google Play pages
Have I Been Squatted found Corp MDM, a small Android implant that takes newly arriving SMS and switches on call forwarding, sharing one hard-coded address with the credential phishing and Windows malware aimed at the same sector.
The Watch · Security desk
What happened
- Have I Been Squatted found fake Google Play pages branded as CEVA and TKW Logistics serving an Android package dressed up as a system service.
- Once sideloaded, the app asks for SMS, telephony and notification permissions, removes its own launcher entry and keeps running in the background.
- Both samples call one hard-coded address, 69.55.61.82, which also hosts the campaign's credential-phishing lures and its Windows malware for logistics firms.
- The implant takes only SMS that arrive after the permission is granted and does not go back through the existing inbox.
Why it matters
- Who's exposed exposure Exposure starts at the permission prompt, so any account whose verification or recovery text lands on that handset afterwards is reachable, whatever the inbox held before.
- What's now possible capability Unconditional forwarding to an operator-chosen number hands over the voice channel, so a callback to confirm a load or a payment can ring the attacker instead of the dispatcher.
- Who has to decide decision One firewall and proxy entry covers the mobile half of this campaign, because 69.55.61.82 carries the Android C2, the lure hosting and the Windows staging.
- What it limits constraint Delivery depends on a user sideloading from an attacker domain, so device policy that blocks unknown-source installs stops it before any permission is granted.
Next story · Security · yesterday
Proofpoint signs a merger agreement to acquire VaronisConfirmed17 publishers
On the network side the implant is loud. Each install registers an Android identifier with the server, sends a heartbeat every 30 seconds, and polls for commands on a loop [7]. At that interval one phone makes 2,880 heartbeat requests a day, which is 86,400 seconds divided by 30 [23]. Its SMS reports carry the sender, the full message body and the received timestamp alongside the device identifier [8].
"SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP," security researcher Ben Folland said [15].
The operator console is a password-protected panel on port 3456 [9]. It lists seven commands and the implant answers five of them [24]. get_location and lock_device are panel-only [11]. sync_sms reports that a sync has started and collects nothing [10]. That leaves forwarding on, forwarding off via ##21#, a ping that returns "pong", and a self-destruct that stops the service and requests app-data clearing [10].
Folland described Corp MDM as a "compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service" [13]. The report calls it narrow by design, without functions usually found in commercial Android spyware [16], and suspects the developer used AI during the build, citing bugs that interfere with the malware's own capabilities [17]. "That limited collection path is sufficient to expose high-value content," Folland said [14].
Attribution is not settled. Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel interface and in source code tied to the wider campaign [19].
Others have worked this sector already. Proofpoint documented a campaign in November 2025 that installed remote monitoring and management software on trucking and logistics companies for financial gain and cargo theft [20]. In February, Ctrl-Alt-Intel and Have I Been Squatted described a cluster they codenamed Diesel Vortex that singled out freight and logistics firms in the United States and Europe, among them DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka and Electronic Funds Source [21]. Corp MDM arrives inside a campaign that is already running credential phishing and Windows malware against the same targets from the same address [5][18].
What to watch
- Whether a later build implements get_location and lock_device, which the panel already exposes.
- Whether the operators move off the single hard-coded IP onto hosting that survives a block.
- Whether any named logistics firm confirms call forwarding used for cargo diversion or payment fraud.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A new campaign targeting the logistics sector distributes an Android spyware codenamed Corp MDM.
- [2]
According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit file dressed up as a system service.
- [3]
The delivered app has the package name com.corp.mdm.
- [4]
The malicious packages are distributed via bogus Google Play Store pages including playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help.
- [5]
Both artifacts use a hard-coded IP address, 69.55.61[.]82, for command-and-control, as well as for hosting credential-phishing lures and serving additional Windows malware targeting the logistics sector.
- [6]
Once sideloaded and installed, the app requests SMS, telephony and notification permissions, allowing it to intercept incoming SMS, enable call forwarding and display notifications; it also removes its normal launcher while ensuring background execution.
- [7]
The implant registers an Android identifier with the C2 server, sends heartbeat telemetry every 30 seconds, and repeatedly polls for commands.
- [8]
Endpoints include /api/v1/devices/register, /api/v1/devices/heartbeat, /api/v1/devices/{ANDROID_ID}/commands, /api/v1/commands/result, and /api/v1/sms/report, which transmits the SMS sender, message body and received timestamp along with the device identifier.
- [9]
The attacker-controlled infrastructure hosts a password-protected Corp MDM admin panel on port 3456 that allows the operator to commandeer infected devices and send commands.
- [10]
Supported commands are ping (returns "pong"), forward_on (issues an unconditional call-forwarding code to an operator-selected number), forward_off (requests cancellation of unconditional forwarding with ##21#), sync_sms (reports initiation of the sync process without performing data collection), and self_destroy (disables implant components, stops the service and requests app-data clearing).
- [11]
get_location and lock_device are supported by the panel but not by the malware.
- [12]
Corp MDM's SMS stealing is limited to new inbound messages received after the permission is granted, and it does not retroactively exfiltrate the SMS inbox contents.
- [13]
Security researcher Ben Folland said Corp MDM is a "compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service."
- [14]
"That limited collection path is sufficient to expose high-value content," Folland said.
- [15]
"SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP," Folland said.
- [16]
The malware has been described as narrow by design, lacking spyware functions typically observed in commercial Android spyware.
- [17]
It is suspected that the threat actor used artificial intelligence during the development phase, given the presence of bugs that interfere with the malware's capabilities.
- [18]
The activity is said to be part of a broader campaign targeting the logistics sector using credential phishing and Windows-based malware.
- [19]
It is unclear who is behind the operation, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign.
- [20]
In November 2025, Proofpoint detailed a campaign that infected trucking and logistics companies with remote monitoring and management software for financial gain and cargo theft.
- [21]
In February, Ctrl-Alt-Intel and Have I Been Squatted described a threat cluster codenamed Diesel Vortex that singled out freight and logistics entities in the U.S. and Europe, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka and Electronic Funds Source.
- [22]
Blocking the single hard-coded address 69.55.61[.]82 removes the Android command-and-control channel, the credential-phishing lure hosting and the Windows malware delivery at the same time.
- [23]
A 30-second heartbeat interval means one infected phone makes about 2,880 heartbeat requests to the C2 server per day.
- [24]
Of the seven commands the admin panel offers, five are implemented in the implant.
Sources
2 independent publishers whose own reporting we read for this story.
- Have I Been Squatted
haveibeensquatted.com
1 article · September 24, 2026
- thehackernews.comCorp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
1 article · September 24, 2026
Topics and entities
Topics
- Android Malware
- SMS interception
- Logistics and freight cybercrime
- Brand Impersonation Phishing
Entities
- Google Play
- Have I Been Squatted
- Proofpoint