Security2 publishers2 min readPublished
Corp MDM reaches logistics staff phones through fake CEVA and TKW Google Play pages
Have I Been Squatted found Corp MDM, a small Android implant that takes newly arriving SMS and switches on call forwarding, sharing one hard-coded address with the credential phishing and Windows malware aimed at the same sector.
The Watch · Security desk
What happened
- Have I Been Squatted found fake Google Play pages branded as CEVA and TKW Logistics serving an Android package dressed up as a system service.
- Once sideloaded, the app asks for SMS, telephony and notification permissions, removes its own launcher entry and keeps running in the background.
- Both samples call one hard-coded address, 69.55.61.82, which also hosts the campaign's credential-phishing lures and its Windows malware for logistics firms.
- The implant takes only SMS that arrive after the permission is granted and does not go back through the existing inbox.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Exposure starts at the permission prompt, so any account whose verification or recovery text lands on that handset afterwards is reachable, whatever the inbox held before.
- capability Unconditional forwarding to an operator-chosen number hands over the voice channel, so a callback to confirm a load or a payment can ring the attacker instead of the dispatcher.
- decision One firewall and proxy entry covers the mobile half of this campaign, because 69.55.61.82 carries the Android C2, the lure hosting and the Windows staging.
- constraint Delivery depends on a user sideloading from an attacker domain, so device policy that blocks unknown-source installs stops it before any permission is granted.
On the network side the implant is loud. Each install registers an Android identifier with the server, sends a heartbeat every 30 seconds, and polls for commands on a loop [7]. At that interval one phone makes 2,880 heartbeat requests a day, which is 86,400 seconds divided by 30 [1]. Its SMS reports carry the sender, the full message body and the received timestamp alongside the device identifier [8].
"SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP," security researcher Ben Folland said [15].
The operator console is a password-protected panel on port 3456 [9]. It lists seven commands and the implant answers five of them [2]. get_location and lock_device are panel-only [11]. sync_sms reports that a sync has started and collects nothing [10]. That leaves forwarding on, forwarding off via ##21#, a ping that returns "pong", and a self-destruct that stops the service and requests app-data clearing [10].
Folland described Corp MDM as a "compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service" [13]. The report calls it narrow by design, without functions usually found in commercial Android spyware [16], and suspects the developer used AI during the build, citing bugs that interfere with the malware's own capabilities [17]. "That limited collection path is sufficient to expose high-value content," Folland said [14].
Attribution is not settled. Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel interface and in source code tied to the wider campaign [19].
Others have worked this sector already. Proofpoint documented a campaign in November 2025 that installed remote monitoring and management software on trucking and logistics companies for financial gain and cargo theft [20]. In February, Ctrl-Alt-Intel and Have I Been Squatted described a cluster they codenamed Diesel Vortex that singled out freight and logistics firms in the United States and Europe, among them DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka and Electronic Funds Source [21]. Corp MDM arrives inside a campaign that is already running credential phishing and Windows malware against the same targets from the same address [5][18].
What to watch
- Whether a later build implements get_location and lock_device, which the panel already exposes.
- Whether the operators move off the single hard-coded IP onto hosting that survives a block.
- Whether any named logistics firm confirms call forwarding used for cargo diversion or payment fraud.