A new Android spyware strain, dubbed Corp MDM, is surging across the logistics industry, leveraging fake Google Play pages disguised under partner brands like CEVA and TKW Logistics to distribute a malicious APK file named “com.corp.mdm.” Victim companies are typically in freight, transport, and delivery networks. The malware poses as a system service to hide its tracks. It slips through via sideloading — not official store downloads. Its stealth includes removing launcher icons and running in the background. Its capabilities include intercepting new incoming SMS messages, forwarding phone calls, and sending notifications once GPS, telephony, SMS, and notification permissions are granted.
What the Spyware Does
After installation, Corp MDM registers the device with its command-and-control (C2) server and sends out heartbeat messages every 30 seconds. It also polls for new commands from operators via endpoints like /api/v1/devices/{ANDROID_ID}/commands. SMS content — including sender address, message body, and timestamp — is exfiltrated. Cleartext HTTP is used, exposing the data in transit.
The spyware includes commands for turning call forwarding on or off, self-destructing (removing all app data and stopping its services), syncing SMS without exfiltration, and other controls via a password-protected admin panel. Though the panel includes options like retrieving location or locking the device, those aren’t supported in the malware itself.
How It’s Spread and Who’s Affected
To spread the malware, threat actors are setting up fraudulent Google Play-like pages under domains such as playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help. These sites also carry credential-phishing lures and host additional Windows malware targeting the logistics sector. Both types of campaigns share the same hard-coded IP at the center: 69.55.61[.]82, which acts as their C2 hub. Victims agreeing to install the fake apps are giving them wide permission scope — at which point Corp MDM performs its functions.
While full retroactive access to past SMS messages isn’t possible, even just capturing incoming messages going forward allows access to sensitive content. One-time passcodes, shipment updates, delivery notifications, password resets — these frequently arrive via SMS, and Corp MDM captures the sender, full body, and timestamp for each. All traveled in clear text.
Origin Speculation & Sector Risks
The group behind Corp MDM isn’t definitively known, but signs point to an Armenian or Russian origin. Clues include localized elements in the malware’s source code and in the admin panel. Corp MDM adds to a growing list of malware campaigns such as Diesel Vortex, which targeted logistics and freight companies in the US and Europe, and operating models like Global Profit that used phishing-as-a-service to steal thousands of credentials. Earlier incidents have compromised cargo information, intercepted shipment updates, and disrupted operations in the transport industry.
This campaign isn’t the first targeting logistics; past operations have included RMM (remote monitoring and management) tools to loot companies financially, intercept communications, or hijack operations. The supply chain is particularly vulnerable due to high volumes of mobile devices used for dispatch, tracking, and customer interaction — a perfect vector for malware posing as business apps.
What to Watch For:
- Bogus Google Play-style domains with names mimicking logistics brands;
- Unexpected prompts for SMS, telephony, and notification permissions;
- Apps disappearing from launcher post-install;
- Devices showing unexplained call forwards or missing SMS data.
Logistics firms should urgently audit their mobile apps, enforce strict sideloading policies, and deploy network monitoring to detect suspicious cleartext transmissions. Phishing training remains vital since credential theft often leads to deeper compromises.
The implications are severe. With SMS frequently used for critical business notifications and security controls like MFA (multi-factor authentication), this spyware represents a direct threat to operations, finance, and privacy. Across the logistics sector — already reeling from pressure of supply chain disruptions — malware like Corp MDM begs tougher defenses. What to watch next: attribution efforts, whether additional capabilities like persistent tracking or retroactive SMS access appear, and how regulators and service providers respond. The battle over mobile security in logistics has only just begun.
