[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6qpUCJWFeG1iA2OZAh5WZPzG2OsDY-EpLLgtAXefTMw":3},{"article":4,"iocs":47,"watch_terms":58,"solutions":59,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"76372df0-d337-4739-9be0-a6be814b752c","Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls","corp-mdm-spyware-targets-logistics-firms-steals-new-sms-and-redirects-calls-00d7c4","The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name \"com.corp.mdm\" Corp MDM","A new Android spyware campaign, dubbed Corp MDM, is targeting the logistics sector by distributing malicious APK files through fake Google Play pages impersonating logistics companies. The spyware is designed to steal SMS messages, redirect calls, and maintain a hidden foreground service, with evidence suggesting AI may have been used in its development. The campaign also involves credential phishing and Windows-based malware, indicating a broader effort against the logistics industry.","New Android spyware 'Corp MDM' targets logistics firms via fake Google Play pages.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcorp-mdm-spyware-targets-logistics.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhitRqKj3-JlcQ69xxlsxJs80aq7MNxgAc_VrV-TCrHGTVEwdWKIdvAiwB4szXMT3cRKpkzCRVObZxAO47CLl3JWLRerxVSITKy9xorsP-XY212M07JzDkZ7VXOA-r0maycB0jMv0r5Kl3q0VgrxpoeYfHJ_gkeXbzXLKz_3gAhDGy1ML06lfta_5w8u_Xo\u002Fs1600\u002F1000110893.jpg","2026-09-24T12:05:27+00:00","2026-09-24T14:00:21.16801+00:00",8,[17,20,23,26],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Play","product",{"name":24,"type":25},"Android","technology",{"name":27,"type":28},"Have I Been Squatted","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,54],{"type":49,"value":50,"context":51},"domain","playgoogle.logisticstkwcargo[.]com","Fake Google Play Store page distributing Corp MDM",{"type":49,"value":53,"context":51},"playgoogle.ceva-app[.]help",{"type":55,"value":56,"context":57},"ip","69.55.61[.]82","Command-and-control (C2) server and phishing lure host",[18,21],{"controls":60,"vendors":134},[61,82,111],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[66,74],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":83,"name":84,"problem":85,"products":86},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":112,"name":113,"problem":114,"products":115},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[116,124,129],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":125,"product_name":126,"url":127,"description":128},"cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":130,"product_name":131,"url":132,"description":133},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":151},"corp-mdm-spyware-hijacks-logistics-firms-via-fake-app-pages","Corp MDM Spyware Hijacks Logistics Firms via Fake App Pages","The Corp MDM campaign exploits employees' trust in familiar brand names by distributing malicious Android APKs through convincing fake Google Play pages impersonating legitimate logistics companies. Once installed, the spyware silently steals SMS messages, redirects calls, and maintains persistent hidden services — giving attackers deep access to sensitive operational and credential data. The use of AI in development signals a rapidly lowering barrier for sophisticated mobile malware creation, making detection harder. This matters because logistics firms handle time-sensitive, high-value supply chain data, making them lucrative targets for espionage and disruption. A single compromised device can cascade into broader organizational breaches through harvested credentials and intercepted communications.",[140,141,142,143,144,145,146,147,148,149,150],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 10: Malware Defenses","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST PR.AT-1: Security Awareness and Training","GDPR Article 32: Security of Processing (data protection by design)","MITRE ATT&CK Mobile T1476: Deliver Malicious App via Other Means","MITRE ATT&CK Mobile T1412: Capture SMS Messages","ISO\u002FIEC 27001 A.6.2.1: Mobile Device Policy",{"NIST AC-17: Remote Access":152,"CIS Control 10: Malware Defenses":153,"NIST SI-3: Malicious Code Protection":154,"ISO\u002FIEC 27001 A.6.2.1: Mobile Device Policy":155,"NIST PR.AT-1: Security Awareness and Training":156,"MITRE ATT&CK Mobile T1412: Capture SMS Messages":157,"CIS Control 9: Email and Web Browser Protections":158,"MITRE ATT&CK Mobile T1476: Deliver Malicious App via Other Means":159,"GDPR Article 32: Security of Processing (data protection by design)":160,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":161,"NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices":162},"Remote access controls limit what stolen SMS codes can be used for.","Malware defences on mobile devices help detect the Corp MDM spyware.","Malicious code protection helps detect spyware on mobile devices.","A mobile device policy defines permitted app sources and security settings.","Awareness training teaches staff to install apps only from official stores.","Stealing SMS messages, including one-time codes, is the technique this entry describes.","Web protections help block access to fake Google Play pages.","Delivering malicious apps through fake store pages is the technique this entry describes.","Protecting employee devices and data is part of Article 32's appropriate measures.","Secure configuration of mobile devices, such as blocking sideloading, would stop the fake APKs being installed.","Mobile device security guidance helps organisations manage app sources and permissions."]