Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
Summary: A new Android spyware campaign codenamed Corp MDM is distributing a malicious APK through fake Google Play pages branded as CEVA and TKW Logistics, using the package name "com.corp.mdm" and a hard-coded command-and-control IP address (69.55.61[.]82). Once sideloaded, the app requests SMS, telephony, and notification permissions, registers with the C2 server, sends heartbeat telemetry every 30 seconds, and polls for commands, with a password-protected admin panel on port 3456 letting the operator commandeer infected devices.
Why it matters: Corp MDM exfiltrates the sender, full body, and timestamp of every new inbound SMS over cleartext HTTP - the same channel that carries one-time passcodes, password resets, and account recovery codes - and Have I Been Squatted says the activity likely has an Armenian or Russian nexus.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026