Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
New Android spyware 'Corp MDM' targets logistics firms via fake Google Play pages.
A new Android spyware campaign, dubbed Corp MDM, is targeting the logistics sector by distributing malicious APK files through fake Google Play pages impersonating logistics companies. The spyware is designed to steal SMS messages, redirect calls, and maintain a hidden foreground service, with evidence suggesting AI may have been used in its development. The campaign also involves credential phishing and Windows-based malware, indicating a broader effort against the logistics industry.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Corp MDM campaign exploits employees' trust in familiar brand names by distributing malicious Android APKs through convincing fake Google Play pages impersonating legitimate logistics companies. Once installed, the spyware silently steals SMS messages, redirects calls, and maintains persistent hidden services — giving attackers deep access to sensitive operational and credential data. The use of AI in development signals a rapidly lowering barrier for sophisticated mobile malware creation, making detection harder. This matters because logistics firms handle time-sensitive, high-value supply chain data, making them lucrative targets for espionage and disruption. A single compromised device can cascade into broader organizational breaches through harvested credentials and intercepted communications.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — playgoogle.logisticstkwcargo[.]com
- domain — playgoogle.ceva-app[.]help
- ip — 69.55.61[.]82