A new Android spyware called Corp MDM is impersonating legitimate logistics platforms to steal one-time passcodes and redirect calls from freight workers’ phones. It’s narrow by design. That’s what makes it dangerous.

On September 22, 2026, security researcher Ben Folland of Have I Been Squatted published a technical breakdown of an Android spyware implant he’d named Corp MDM. The campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit file dressed up as a system service. The delivered app’s package name is “com.corp.mdm.” Once it’s on a phone, it quietly reads every inbound text message and can forward every call to a number the operator chooses. The operator sits behind a password-protected admin panel. The phone’s owner has no idea any of this is happening.

That’s the news. It’s not a sophisticated nation-state tool. The malware has been described as narrow by design, lacking in spyware functions typically observed in commercial Android spyware. Narrow is the point. The people running this campaign don’t need a keylogger or a camera or a GPS feed. They need one thing: the six-digit code your bank, TMS, or EFS account texts you before it lets anyone log in. Corp MDM is built to catch exactly that and nothing more.

The activity is part of a broader campaign targeting the logistics sector with credential phishing and Windows-based malware. The Android implant is the last piece of a three-layer attack. Phish the credentials on a fake web page. Intercept the one-time passcode on the phone. Own the account. The infrastructure running all three layers traces back to a single IP address: 69.55.61[.]82. That C2 server also hosted credential-phishing pages, Windows malware, and a password-protected panel used to administer compromised devices. One box, one operator console, three attack surfaces.

The delivery mechanism deserves a plain-language walk-through, because it’s the part that catches people who think they’re careful. The campaign uses fake Google Play pages, not the real Play Store, but pages designed to look like it. The URLs are playgoogle. logisticstkwcargo[.]com and playgoogle. ceva-app[.]help. They won’t pass a close look, but a dispatcher who gets a link in a Telegram message or a text and taps it on a phone isn’t doing a close look. They’re doing a quick tap. The app asks for SMS, telephony, and notification permissions. Those requests look routine on a phone that runs a dozen logistics apps, most of which want location and contact access. The driver or dispatcher grants them. The app then removes its own launcher icon so it disappears from the home screen while staying alive in the background. Industry term for what that achieves: a hidden foreground service. Plain term: it’s invisible, and it doesn’t stop running.

Once active, the implant registers an Android device identifier with the C2 server, sends heartbeat telemetry every 30 seconds, and polls repeatedly for commands through a structured API: register the device, send a heartbeat, receive commands, post results, and transmit captured SMS content including the sender, the full message body, and a timestamp. The call-forwarding mechanism uses USSD codes the same unstructured supplementary service data strings you’d use to dial *#21# to check your own forwarding settings. The forward_on command pushes an unconditional call-forwarding code to an operator-selected number. Every call you receive goes there instead, and you may never know, because your phone still rings before forwarding kicks in depending on the carrier’s timing.

Folland flagged something worth sitting with about how the SMS theft actually works. Corp MDM doesn’t pull the existing inbox. It’s a “compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service,” meaning it only catches texts that arrive after it’s installed and permissions are granted. That sounds like a limitation. It isn’t. The attacker doesn’t need your message history. They need to catch the next one-time passcode your bank sends, or the next dispatch code your TMS pushes, or the next account-recovery link your EFS account generates. “SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates,” Folland wrote in his analysis. The sender, the full body, and the timestamp all leave the device over cleartext HTTP. No encryption on the exfiltration channel. That’s not an oversight; it’s a speed choice.

It’s suspected the threat actor used artificial intelligence during development, given the bugs that interfere with its capabilities. Two commands on the admin panel, get_location and lock_device, aren’t actually functional in the malware itself. The panel supports them; the implant doesn’t respond. That’s consistent with AI-assisted development where generated code passes a syntax check but hasn’t been tested end-to-end. The operator still has what they need. The broken commands tell us how the tool was built, not that it won’t be extended later.

It’s currently unclear who is behind the operation, but Have I Been Squatted said the activity likely has an Armenian or Russian nexus, citing localized artifacts in the panel user interface and source code associated with the wider campaign. That’s a lead, not a finding. Shared language artifacts in source code establish where someone’s keyboard probably was. They don’t establish who was sitting at it or what they intended to do with the money.

This campaign doesn’t arrive in a vacuum. In November 2025, Proofpoint detailed a campaign that infected trucking and logistics companies with remote monitoring and management software for financial gain and cargo theft. Before that, in February 2026, Have I Been Squatted, in joint collaboration with Ctrl-Alt-Intel, uncovered a sophisticated criminal phishing operation run by a Russian threat actor group designated Diesel Vortex. The group spent at least five months systematically targeting freight and logistics companies across the United States and Europe, stealing over 1,600 unique login credentials from users of major logistics platforms including DAT Truckstop, Penske Logistics, Electronic Funds Source, and Timocom. Telegram webhook logs recovered from the platform showed Armenian-language coordination among operators, indicating an Armenian-speaking component alongside the Russian infrastructure ties. That same Russian-Armenian fingerprint is showing up on Corp MDM today. No confirmed link has been established between Corp MDM and Diesel Vortex. What’s confirmed is that the same sector, the same credential targets, the same language artifacts, and the same attack pattern keep reappearing on a tightening timeline.

After the Diesel Vortex credential theft, a coordinated fraud operation redirected shipments, laundered money through check fraud, and exploited the logistics industry’s dependence on broker platforms to run double-brokering scams at scale. Corp MDM closes the one gap that phishing alone can’t close: the one-time passcode. A stolen username and password gets you to the login screen. The SMS intercept gets you past it. Add call forwarding to intercept account-recovery phone calls, and you own the account completely, including any attempt the real user makes to regain it. The long tail of logistics, with 90% of fleets operating fewer than 10 trucks, often lacks mature cybersecurity controls, and the people most likely to install an app from a link in a Telegram message are the ones dispatching freight from a personal Android phone with no mobile device management policy behind it.

Three things to do today. First, check every Android device in your operation driver phones, dispatcher phones, any device that receives TMS or EFS or load board notifications for an app with the package name com.corp.mdm. It won’t appear on the home screen, so you’re looking in Settings, then Apps, then all installed packages. If it’s there, revoke its permissions immediately, clear its data, uninstall it, and change every credential on every platform that phone has accessed since the installation date. Second, block the two delivery domains at your network perimeter and in any mobile security tooling you run: playgoogle. logisticstkwcargo[.]com and playgoogle. ceva-app[.]help. Third, tell your drivers and dispatchers now, plainly, that no legitimate logistics platform will ever ask them to install an app from a web link. CEVA has a real app. TKW Logistics has a real app. Both are distributed through the actual Google Play Store. Anything else is the campaign.

The operator behind Corp MDM hasn’t been identified. The infrastructure is live as of today.