Researchers at Have I Been Squatted have documented a new Android spyware family called Corp MDM that targets the logistics sector, stealing incoming SMS messages and redirecting phone calls. The app carries the package name com.corp.mdm and presents itself as a system service, which is why a driver or dispatcher installing it sees nothing unusual on the device afterward. Details in this article come from analysis published by The Hacker News.

Victims encounter it through fake Google Play Store pages branded as CEVA and TKW Logistics, hosted at playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help. Both samples point to the same hard-coded command-and-control address, 69.55.61[.]82, which also serves credential-phishing lures and Windows malware aimed at the same industry. If your carriers, brokers, or freight partners use branded mobile apps for load tracking or driver enrolment, that branding is the pretext the operators borrowed.

Security researcher Ben Folland describes Corp MDM as a "compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service." It is narrow by design and lacks the broad feature set of commercial Android spyware, and the presence of bugs that break some of its own capabilities suggests the developer used AI during the build.

The two channels it controls are the ones most account verification travels over. SMS carries one-time passcodes, password resets, account recovery links, transaction alerts, and dispatch updates, while unconditional call forwarding hands the attacker any voice-based bank verification call.

"The sender, full body, and timestamp all leave the device over cleartext HTTP," Folland said.

Attribution remains open, though localized artifacts in the operator panel and in code tied to the wider campaign point to an Armenian or Russian nexus. That aligns with two previously tracked clusters in the same sector: Diesel Vortex, which targeted freight platforms including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source, and the phishing-as-a-service platform Global Profit (also called MC Profit Always), run by a Russian-Armenian actor.

How Corp MDM Steals SMS and Redirects Calls

Installation happens by sideload, not by Play Store delivery, so the victim has already accepted an "unknown sources" warning before the app runs. The name itself does the persuasion work. An app presenting as mobile device management is exactly the kind of thing a dispatcher or driver expects a carrier's IT department to push onto a work phone, which makes the permission prompts that follow look routine.

On first launch the app requests SMS, telephony, and notification access. Those three grants map to the whole of its capability set: reading inbound messages (ATT&CK T1636.004, Protected User Data: SMS Messages), enabling call forwarding (T1616, Call Control), and posting notifications. It then removes its own launcher entry, so there is no icon to long-press and uninstall (T1628.001, Suppress Application Icon), and keeps a foreground service alive to avoid being killed by Android's background process limits (T1541, Foreground Persistence).

Check-in is straightforward HTTP. The implant registers the device's Android ID with basic device information, then beacons on a fixed schedule and polls for tasking:

• /api/v1/devices/register for initial enrollment
• /api/v1/devices/heartbeat every 30 seconds
• /api/v1/devices/{ANDROID_ID}/commands to pull operator tasking
• /api/v1/commands/result to return execution output
• /api/v1/sms/report to ship sender, full message body, and received timestamp

The 30-second heartbeat and repeated command polling produce a consistent outbound pattern to a single host, which is the kind of traffic that stands out on a corporate Wi-Fi network even when the handset itself is unmanaged.

Operators drive infected devices through a password-protected admin panel running on port 3456. The supported command set is short: ping returns "pong" through the result endpoint, forward_on issues an unconditional call-forwarding code to an operator-chosen number, forward_off cancels it with ##21#, sync_sms reports that a sync started without actually collecting anything, and self_destroy disables the implant, stops the service, and requests that app data be cleared. The panel also exposes get_location and lock_device, neither of which the malware implements.

That gap between panel and payload, along with the non-functional sync_sms command, is part of why researchers suspect AI-assisted development. Bugs interfere with advertised capability, and the implant lacks the microphone, camera, and file-collection features common in commercial Android surveillance tooling.

Collection is also narrower than it first appears. SMS theft only covers messages that arrive after the permission grant, with no retroactive dump of the existing inbox. For a logistics operation that is enough, because those inbound messages carry one-time passcodes, password reset links, account recovery codes, transaction alerts, and dispatch or delivery updates. Call forwarding covers the voice side of the same problem, routing carrier callbacks or broker verification calls to a number the operator controls.

Everything leaves the device over cleartext HTTP, so message contents are readable to anyone positioned on the path as well as to the operator.

The Android implant is one piece of a wider effort against freight and logistics that has also included credential phishing, Windows malware, and, in separate reporting by Proofpoint from November 2025, abuse of legitimate remote monitoring and management software against trucking firms for cargo theft. Treat every indicator here as reporting-derived. Validate the domains, IP, port, and URI paths against your own telemetry before adding them to a blocklist, since shared hosting and reused infrastructure can cause collateral blocking.

What SMS Interception Means for Organizations and Corporate Accounts

The malware only captures messages that arrive after the permissions are granted, which sounds like a limitation until you consider what actually arrives by SMS on a work phone. One-time passcodes, password reset links, account recovery confirmations, transaction notifications, and dispatch updates all land in that window. If your finance manager's phone is infected on a Monday, every code sent to that number from that point forward reaches the operator before your staff member reads it.

The sender, the full message body, and the received timestamp all leave the device over cleartext HTTP to the attacker's reporting endpoint. That means the content is readable in transit as well as at the destination, so anyone positioned on the same network path sees the same passcodes. For your business, that turns SMS-based multi-factor authentication into an authentication step the attacker can complete on your behalf.

Call diversion compounds it. With unconditional forwarding set to a number the operator chooses, the verification call your bank places to confirm an unusual payment rings on the attacker's handset. Your staff member sees no missed call and no alert, so the first indication of a problem is usually the reconciliation that does not balance.

Think about whose phones matter most here. Executives, controllers, and accounts payable staff typically hold the reset paths for corporate email, the finance platform, the carrier portals, and the payroll system. An attacker holding inbound SMS for one of those numbers can initiate password resets across your SaaS estate and work through them one at a time, using your own recovery mechanisms as the route in.

The bring-your-own-device angle deserves attention. If your drivers and dispatchers use personal phones enrolled in a genuine management platform, a second app claiming to be a system service sits alongside real corporate tooling without looking out of place, and your visibility into what is installed on a personal handset is usually partial at best. That leaves you assessing a compromise on a device you do not fully control while corporate credentials are already resident on it.

This capability feeds directly into the fraud patterns already documented against the sector. The Russian-Armenian operators behind the Global Profit phishing-as-a-service platform intercepted logins and multi-factor codes in real time, then used that access for invoice redirection and double-brokering, taking shipment information, personal details, and funds.

Invoice redirection and double-brokering are where the money goes. A diverted payment instruction sends your customer's remittance to an attacker-controlled account, and a double-brokered load means the cargo is handed to a carrier you never contracted with. Recovering redirected funds depends on how fast the receiving bank acts, and in practice your business often absorbs the loss and pays the supplier or customer again.

Then come the questions you have to answer afterward. If a confirmed infection sat on a phone holding corporate mail credentials and customer contact details, you need to establish what account access followed, which personal data was reachable through those accounts, and whether that triggers a reporting obligation under your data protection regime. Your bank will also want to know whether the fraudulent transfer was authorised by a compromised device, because that determines who carries the liability. The self_destroy command lets the operator disable the implant and clear its app data, so the evidence you need for those determinations may already be gone by the time you look.

Detecting Corp MDM on Managed and BYOD Devices

Start with your mobile device inventory. Query your MDM console and any mobile threat defense or EDR telemetry for the package identifier com.corp.mdm, then widen the search to every sideloaded application holding device-administrator rights on a corporate or BYOD handset. Drivers and dispatchers are the population to check first, because they are the ones receiving the lures.

On any handset that returns a hit, check call forwarding before you touch the app. Dial ##21# on the device to cancel unconditional forwarding, then call the mobile carrier and confirm no forwarding rule remains active on the line. Carrier-side forwarding survives an app uninstall, so skipping that call leaves the operator's number in the path for voice verification calls.

Block the hard-coded C2 address and both spoofed Play Store hostnames at your DNS resolver and egress firewall. Add a watch for cleartext HTTP sessions from mobile subnets to that host, and for any traffic to TCP port 3456, which is where the operator's password-protected admin panel runs. Registration, heartbeat, and command polling all traverse the same channel, so a single blocked egress path cuts device control and SMS reporting together.

Removal has an order to it. Revoke device-administrator rights first, because the uninstall will fail while those rights are held, then wipe the handset and re-enrol it from a clean build. Do not settle for an in-place uninstall on a device you know was compromised.

Then work the identity side, which is where the real cost sits:

• Force password resets and revoke active sessions and refresh tokens for every account tied to the affected phone number, including email, load boards, transport management systems, and banking portals.
• Review payment and banking activity over the exposure window, along with any changes to invoice remittance details or carrier payment instructions.
• Re-verify recent account recovery events, since recovery codes delivered by text reach the operator before your staff member reads them.

In environments Capstone manages, Adlumin ITDR watches authentication behaviour for the pattern that follows this kind of compromise, where a valid password and a valid one-time code arrive from a location or device that does not match the user's history. That gives you a detection path for accounts already drained of their SMS codes, rather than waiting for a fraudulent payment to surface.

Longer term, close the delivery route. Disable installation from unknown sources through enterprise policy on managed Android devices, and restrict which applications may be granted device-administrator and accessibility permissions. Allowlist your organisation's genuine management agent and tell drivers and dispatchers its exact package name, so a prompt from anything calling itself a system service is reportable rather than routine.

Move multi-factor authentication off SMS for anything that touches money or freight. Authenticator apps and FIDO2 hardware keys remove the interception path entirely for email, TMS logins, load board accounts, and banking. Text-based codes can stay only where no alternative exists, and those accounts should be treated as the ones most likely to be abused.

Finally, audit remote monitoring and management tooling across the estate. Proofpoint documented trucking and logistics firms infected with RMM software for cargo theft in November 2025, so confirm every RMM agent present was installed by your own team, matches an approved version, and reports to your console rather than an unknown tenant.

Priorities After a Suspected Corp MDM Infection

The campaign's value to the operator rests on one thing: the authentication codes that arrive by text message. Strip that away and the implant is left forwarding calls and reporting message bodies from a phone whose accounts no longer depend on SMS to prove identity.

That makes the priority order straightforward. Find and clean the affected handsets in your fleet, then retire SMS as an authentication factor for banking portals, freight boards, load tender platforms, and any privileged administrative account your dispatch or finance staff touch. App-based authenticators and hardware keys do not travel over the carrier network, so an implant sitting on the device cannot read them off an inbound message.

The operator side of this is more capable than the malware. The admin panel running on port 3456 exposes device location and remote lock functions that the current implant does not actually support, which suggests the build you are looking at today is an early one. A self_destroy command already lets the operator disable the components and clear app data, so evidence on a device can disappear before you reach it.

Corp MDM also sits inside a larger commercial operation. Global Profit, the phishing-as-a-service platform sold to other operators, collected more than 1,600 unique logins between September 2025 and February 2026 and used them for invoice redirection and double-brokering. Track further Diesel Vortex and Global Profit reporting, because the same infrastructure serves Windows malware and credential lures alongside the Android component.