Corp MDM Spyware Targets Logistics Firms with SMS Theft and Call Redirects

"That limited collection path is sufficient to expose high‑value content," security researcher Ben Folland said.

Corp MDM: a compact Android surveillance implant

Researchers at Have I Been Squatted uncovered an Android spyware implant they call Corp MDM, a deliberately narrow surveillance tool built to exfiltrate newly received SMS messages, divert voice calls, and run a hidden foreground service. The delivered package uses the application package name com.corp.mdm and is described by Folland as a "compact surveillance implant" whose design omits many features common to commercial Android spyware.

How the malware behaves on infected devices

After a user sideloads and installs the APK, the malicious app requests SMS, telephony, and notification permissions. These permissions let the implant intercept incoming SMS messages, enable unconditional call forwarding to an attacker-chosen number, and display notifications while it removes its normal launcher and ensures persistent background execution.

The implant registers an Android identifier with the actor-controlled command-and-control (C2) server and sends heartbeat telemetry every 30 seconds. It repeatedly polls a command endpoint to receive instructions and posts command results and SMS reports back to the C2 infrastructure. Reported API endpoints observed in the campaign include:

• /api/v1/devices/register — to register the device along with basic information
• /api/v1/devices/heartbeat — to send heartbeat messages
• /api/v1/devices/{{ANDROID_ID}}/commands — to receive commands
• /api/v1/commands/result — to post execution results
• /api/v1/sms/report — to transmit SMS sender, message body, and received timestamp together with the device identifier

Distribution, infrastructure, and operator controls

Have I Been Squatted mapped the distribution to fake Google Play pages branded as CEVA and TKW Logistics — examples include playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help. Both artifacts use a hard‑coded IP address, 69.55.61[.]82, which serves multiple roles: hosting the APK/C2, hosting credential‑phishing lures, and serving additional Windows malware connected to a wider logistics-focused campaign.

The attacker infrastructure also hosts a password‑protected Corp MDM administration panel on port 3456. That panel allows an operator to command infected devices. Supported panel-issued commands include:

• ping — returns "pong" through the command‑result endpoint
• forward_on — issue unconditional call‑forwarding to an operator‑selected number
• forward_off — request cancellation of unconditional forwarding with ##21#
• sync_sms — report initiation of sync without performing data collection
• self_destroy — disable implant components, stop the service, and request app‑data clearing
• get_location and lock_device — present in the panel but not implemented in the malware

Capabilities, limits, and operational tradeoffs

Corp MDM's SMS exfiltration is limited to new inbound messages received after the malware obtains permission; it does not retroactively harvest existing inbox contents. Still, Folland warned that this limited collection is sufficient to expose "high‑value content" because SMS is commonly used for one‑time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. Have I Been Squatted additionally noted that the SMS sender, full body, and timestamp are transmitted over cleartext HTTP.

The implant lacks many functions seen in mature commercial spyware and contains bugs that impair some capabilities. That combination led researchers to suspect the threat actor used artificial intelligence during development: the presence of errors and the narrow feature set are cited as indicators of automated assistance rather than hand‑crafted, feature‑rich tooling.

Context: this campaign as part of broader targeting of logistics

Have I Been Squatted places Corp MDM inside a larger sequence of operations focused on freight and logistics. The organization said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign. Earlier reporting and incident timelines cited by researchers include:

• Proofpoint's November 2025 detailing of a campaign that used remote monitoring and management (RMM) software to target trucking and logistics companies for financial gain and cargo theft.
• Ctrl‑Alt‑Intel and Have I Been Squatted's February reporting on a cluster dubbed Diesel Vortex that targeted U.S. and European freight and logistics entities, including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS).
• Discovery of a phishing‑as‑a‑service platform codenamed Global Profit (aka MC Profit Always) that targeted the freight and logistics sector, stealing over 1,600 unique login credentials between September 2025 and February 2026. Have I Been Squatted said "This operation was not the work of a lone actor," describing Global Profit as a structured, financially driven service that enabled spear‑phishing and voice‑phishing campaigns, real‑time interception of logins and multi‑factor authentication codes, and tactics such as invoice redirection and double‑brokering.

What this means for technologists, logistics firms, and operators

• Technologists and security teams: watch for sideloaded APKs claiming to be system services and monitor telemetry for devices registering with external endpoints using the observed API patterns and the hard‑coded IP 69.55.61[.]82.
• Logistics firms and procurement leaders: the campaign demonstrates attackers using platform impersonation (fake Play listings) and credential‑phishing alongside malware, reinforcing the risk of supply‑chain and credential compromise tied to operational workflows such as dispatch and delivery updates.
• Operators and cybercrime analysts: the presence of a password‑protected admin panel on port 3456 and unused panel features (get_location, lock_device) suggest development and testing workflows that might yield additional artifacts for attribution and disruption.

Corp MDM is not the most sophisticated implant seen against logistics, but its focused capabilities — SMS capture of ongoing authentication tokens and the ability to redirect calls — position it as a practical tool for real‑time interception and invoice or shipment manipulation. The campaign's reuse of infrastructure for phishing, Windows malware, and Android espionage tightens the operational link between credential theft and device‑level interception, leaving questions about scale and monetization unanswered even as defenders map the same IP and API patterns for detection.

https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html