Corp MDM Android Spyware Targets Logistics Firms: Detection, Hunting, and Remediation Guide

A new Android spyware campaign, codenamed Corp MDM, is actively targeting organizations in the logistics and freight sector. According to reporting from Have I Been Squatted and The Hacker News, the operators behind this campaign are distributing a malicious APK — carrying the package name com.corp.mdm — through fake Google Play pages impersonating CEVA Logistics and TKW Logistics. The application masquerades as a legitimate system service, then proceeds to steal incoming SMS messages and redirect calls, a capability set squarely aimed at intercepting MFA codes, shipment one-time passcodes, and dispatch communications.

This is a supply-chain-adjacent threat in the truest sense: logistics firms sit at the connective tissue of nearly every other industry's operations. An operator who can read your drivers' SMS traffic and reroute their calls can intercept delivery confirmations, hijack two-factor authentication for TMS/WMS platforms, and conduct highly convincing social engineering against downstream customers. If your organization operates in freight, 3PL, last-mile delivery, or depends on logistics partners, treat this as an active-threat situation, not a theoretical one.

No CVE is associated with this campaign — this is a social-engineering-driven sideloading threat, not a vulnerability exploit. The defense problem here is about distribution-channel abuse, sideloaded APKs, and excessive Android permission grants, which is exactly where your detection and hardening effort needs to land.

Technical Analysis

Attack Chain

The campaign follows a pattern we have seen mature significantly across 2025–2026 mobile threats — brand impersonation at the distribution layer, followed by a payload that abuses Android's legitimate device-management and telephony APIs:

1. Lure and impersonation: Victims are directed (typically via smishing, malvertising, or spoofed corporate communications) to fraudulent Google Play–style landing pages branded as CEVA and TKW Logistics. Employees and contractors in the logistics vertical are the deliberate target pool.
2. Sideloaded delivery: Rather than a genuine Play Store install, the victim is induced to download an APK file directly — meaning "Install unknown apps" must be enabled or the user is walked through enabling it. This is a critical choke point defenders can control via MDM policy.
3. Masquerade as a system service: The delivered app presents as a benign system component. Its package name, com.corp.mdm, is itself a social engineering artifact — it is designed to look like a legitimate corporate Mobile Device Management agent so that both end users and cursory audits will scroll past it.
4. Capability execution: Once installed and granted permissions, Corp MDM:
   • Reads newly received SMS messages (consistent with abuse of RECEIVE_SMS/READ_SMS permissions or accessibility-service scraping) — ideal for harvesting OTPs/MFA codes and dispatch codes.
   • Redirects phone calls (consistent with CALL_PHONE, READ_CALL_LOG, PROCESS_OUTGOING_CALLS, or call-forwarding configuration abuse) — enabling voice-phishing interception and suppression of legitimate calls (e.g., a bank's fraud-verification call).
5. Persistence and concealment: By branding as a system service and an "MDM" agent, the app discourages manual removal and may attempt to obtain Device Admin or Accessibility privileges to resist uninstallation.

Why the "MDM" Name Matters

Naming the package com.corp.mdm is a deliberate anti-detection and anti-remediation technique. In logistics environments — where legitimate MDM/EMM agents (Intune, Workspace ONE, SOTI MobiControl, ManageEngine) are ubiquitous on ruggedized Android devices and driver handsets — a package claiming to be a corporate MDM agent blends into the expected software inventory. Any inventory review process that treats "mdm" in a package name as inherently trusted will miss this.

Exploitation Status

• Confirmed active campaign targeting the logistics sector, documented by Have I Been Squatted.
• No CVE; no CISA KEV entry (not applicable — this is not a vulnerability exploit).
• Distribution is live via impersonated app-store pages; treat any APK sourced outside the genuine Play Store as hostile until proven otherwise.

MITRE ATT&CK Mapping (Mobile)

Detection & Response

Mobile threats are chronically under-instrumented in enterprise SOCs. The highest-fidelity signals for this campaign exist at three layers: (1) network/DNS telemetry for the impersonation infrastructure, (2) managed-device inventory for the malicious package, and (3) endpoint file telemetry for APK downloads on corporate workstations (employees sometimes download the APK on a laptop before transferring it). The detections below target all three.

Sigma Rules

These rules are tuned to fire on specific, low-noise observables: the package name string appearing in proxy/DNS/log data, APK downloads referencing impersonated logistics brands, and sideload-style APK retrieval behavior on managed endpoints.

---
title: Corp MDM Spyware Package Name or Impersonation Domain Observed in Network Telemetry
id: 3f8a2c71-6b4d-4e9a-b1c7-9d2e5f8a0b31
status: experimental
description: Detects network or DNS references to the Corp MDM spyware package identifier or to fake app-store domains impersonating CEVA or TKW Logistics used in the Corp MDM distribution campaign.
references:
  - https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.initial_access
  - attack.collection
  - attack.t1476
  - attack.t1612.001
logsource:
  category: proxy
detection:
  selection_pkg:
    cs-uri|contains:
      - 'com.corp.mdm'
      - 'corp.mdm'
  selection_impersonation:
    c-dns|contains:
      - 'ceva'
      - 'tkw-logistics'
      - 'tkwlogistics'
    c-dns|contains:
      - 'play'
      - 'app'
      - 'store'
      - 'download'
  condition: selection_pkg or selection_impersonation
falsepositives:
  - Legitimate traffic to official CEVA or TKW web properties (tune with an allowlist of verified corporate domains)
level: high
---
title: DNS Query for Fake Logistics App-Store Infrastructure
id: 8c1e4b52-2a7f-4d38-9e6b-1c3d7f5a9248
status: experimental
description: Detects DNS resolution attempts for lookalike domains combining logistics brand names (CEVA, TKW) with app-store or download keywords, consistent with Corp MDM spyware distribution pages.
references:
  - https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.initial_access
  - attack.t1476
logsource:
  category: dns
detection:
  selection_brand:
    query|contains:
      - 'ceva'
      - 'tkw'
  selection_context:
    query|contains:
      - 'play'
      - 'apk'
      - 'app-store'
      - 'appstore'
      - 'getapp'
      - 'download'
      - 'install'
      - 'mdm'
  filter_official:
    query|endswith:
      - '.cevalogistics.com'
      - 'cevalogistics.com'
  condition: selection_brand and selection_context and not filter_official
falsepositives:
  - Marketing or CDN subdomains of the legitimate brands (maintain a verified-domain allowlist)
level: high
---
title: APK File Download Referencing Logistics Brand on Managed Endpoint
id: b64d9f03-81c2-4e7a-a5d1-3f8c6b2e7094
status: experimental
description: Detects download of Android APK files whose filename references CEVA, TKW, or MDM branding on Windows endpoints, consistent with Corp MDM sideload staging prior to device transfer.
references:
  - https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.initial_access
  - attack.t1476
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith: '.apk'
  selection_name:
    TargetFilename|contains:
      - 'ceva'
      - 'tkw'
      - 'corp.mdm'
      - 'corp_mdm'
      - 'corp-mdm'
      - 'logistics'
      - 'mdm'
  condition: selection_ext and selection_name
falsepositives:
  - Legitimate enterprise MDM agent APKs distributed by IT (allowlist known-good package filenames and hashes)
level: medium

KQL Hunt (Microsoft Sentinel / Defender)

The following query hunts DNS and network telemetry for the impersonation infrastructure and package-name references. It assumes standard ingestion via DeviceNetworkEvents, DnsEvents (Sentinel), or CommonSecurityLog for firewall/proxy CEF feeds.

// Hunt: Corp MDM spyware distribution infrastructure and package indicators
// Covers DNS, Defender network events, and CEF-ingested proxy/firewall logs
let lookback = 14d;
let brand_terms = dynamic(["ceva", "tkw-logistics", "tkwlogistics", "tkw"]);
let context_terms = dynamic(["play", "apk", "app-store", "appstore", "download", "install", "getapp", "mdm"]);
let official_domains = dynamic(["cevalogistics.com"]); // extend with verified corporate domains
let DnsHits =
    DnsEvents
    | where TimeGenerated > ago(lookback)
    | where Name has_any (brand_terms) and Name has_any (context_terms)
    | where not (Name has_any (official_domains))
    | project TimeGenerated, ClientIP, Name, SourceSystem;
let DefenderHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (brand_terms) and RemoteUrl has_any (context_terms)
       or RemoteUrl contains "com.corp.mdm"
    | where not (RemoteUrl has_any (official_domains))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
let CefHits =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has_any (brand_terms) and RequestURL has_any (context_terms)
       or RequestURL contains "com.corp.mdm"
    | where not (RequestURL has_any (official_domains))
    | project TimeGenerated, SourceIP, RequestURL, DeviceProduct;
union DnsHits, DefenderHits, CefHits
| sort by TimeGenerated desc;

A second query for Defender for Endpoint customers who also have Android devices enrolled — hunt for APK sideload artifacts on workstations that may precede transfer to a handset:

// Hunt: APK files with logistics/MDM branding written to endpoint filesystems
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".apk"
| where FileName has_any ("ceva", "tkw", "corp", "mdm", "logistics", "dispatch", "driver")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FolderPath, FileName, SHA256
| sort by TimeGenerated desc;

Velociraptor VQL Hunt

Use this artifact to sweep Windows endpoints for staged APK payloads matching the campaign's naming patterns — useful where mobile device telemetry is thin but workstation telemetry is strong.

-- Hunt for staged Corp MDM-style APK payloads on endpoint filesystems
SELECT FullPath, Size, Mtime,
       hash(path=FullPath) AS Hashes
FROM glob(globs=['C:/Users/*/Downloads/**/*.apk',
                 'C:/Users/*/Desktop/**/*.apk',
                 'C:/Temp/**/*.apk',
                 'D:/Users/*/Downloads/**/*.apk'])
WHERE FullPath =~ '(?i)(ceva|tkw|corp[._-]?mdm|logistics|dispatch|driver)'
ORDER BY Mtime DESC

Remediation / Verification Script

The most direct eradication path for the spyware itself is on the Android devices. The following Bash script uses ADB (over USB or your EMM's remote ADB capability) to sweep a fleet device list for the malicious package, enumerate suspicious permission grants, and collect forensic evidence before removal. Always collect before you uninstall — you want the APK hash for threat intelligence and blocklisting.

#!/bin/bash
# Corp MDM Spyware - Fleet Detection & Forensic Collection Script
# Requires: adb, authorized devices (USB debugging or EMM remote shell)
# Usage: ./corp_mdm_sweep.sh device_list.txt

DEVICE_LIST="$1"
EVIDENCE_DIR="./corp_mdm_evidence_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"

MALICIOUS_PKG="com.corp.mdm"

while read -r DEVICE; do
  echo "[+] Scanning device: $DEVICE"
  OUT="$EVIDENCE_DIR/${DEVICE}.log"

  # Check for the malicious package
  if adb -s "$DEVICE" shell pm list packages | grep -qi "$MALICIOUS_PKG"; then
    echo "[!] MALICIOUS PACKAGE FOUND on $DEVICE: $MALICIOUS_PKG" | tee -a "$OUT"

    # Forensic collection BEFORE removal
    adb -s "$DEVICE" shell dumpsys package "$MALICIOUS_PKG" >> "$OUT" 2>&1
    APK_PATH=$(adb -s "$DEVICE" shell pm path "$MALICIOUS_PKG" | sed 's/package://' | tr -d '\r')
    adb -s "$DEVICE" pull "$APK_PATH" "$EVIDENCE_DIR/${DEVICE}_corpmdm.apk" 2>/dev/null
    sha256sum "$EVIDENCE_DIR/${DEVICE}_corpmdm.apk" >> "$OUT" 2>/dev/null

    # Check for Device Admin / Accessibility abuse
    adb -s "$DEVICE" shell dumpsys device_policy | grep -i -A5 "$MALICIOUS_PKG" >> "$OUT" 2>&1

    # Disable Device Admin first (uninstall will fail otherwise), then remove
    adb -s "$DEVICE" shell dpm remove-active-admin "$MALICIOUS_PKG/.DeviceAdminReceiver" 2>/dev/null
    adb -s "$DEVICE" shell pm uninstall --user 0 "$MALICIOUS_PKG" | tee -a "$OUT"
  else
    echo "[-] Clean: $MALICIOUS_PKG not present on $DEVICE" >> "$OUT"
  fi

  # Audit: any non-Play-Store package holding SMS or call permissions (broader sweep)
  echo "[*] Auditing risky permission holders on $DEVICE..." >> "$OUT"
  for PKG in $(adb -s "$DEVICE" shell pm list packages -3 | sed 's/package://' | tr -d '\r'); do
    PERMS=$(adb -s "$DEVICE" shell dumpsys package "$PKG" 2>/dev/null | \
            grep -E "RECEIVE_SMS|READ_SMS|PROCESS_OUTGOING_CALLS|CALL_PHONE|BIND_ACCESSIBILITY" | grep "granted=true")
    if [ -n "$PERMS" ]; then
      INSTALLER=$(adb -s "$DEVICE" shell pm get-installer "$PKG" 2>/dev/null)
      echo "[RISK] $PKG holds sensitive telephony/SMS perms | Installer: $INSTALLER" >> "$OUT"
    fi
  done

done < "$DEVICE_LIST"

echo "[+] Sweep complete. Evidence in: $EVIDENCE_DIR"

Remediation

Immediate Actions (24–48 hours)

1. Inventory sweep: Query your MDM/EMM for any device with package com.corp.mdm installed. Do not trust the "MDM" in the name — verify against your actual MDM agent's package identifier. Any third-party (non-Play-Store-installed) package holding SMS, call, or accessibility permissions on a logistics device warrants investigation.
2. Block distribution infrastructure: Add DNS/sinkhole blocks for lookalike domains combining ceva, tkw, and app-store keywords. Work with your threat intel provider for the confirmed malicious domains from the Have I Been Squatted reporting, and submit confirmed phishing pages to Google Safe Browsing.
3. Enforce sideloading restrictions via MDM policy — this is the single highest-value control against this campaign class:
   • Disable "Install unknown apps" / unknown sources on all managed Android devices (Android Enterprise: set install_unknown_sources_allowed to false in your device policy).
   • Enforce Google Play Protect and verify it is active on all enrolled devices.
   • Where operationally feasible, deploy devices in fully managed mode with an allowlisted app catalog.
4. Forensic-collect before removal: On any hit, pull the APK and dumpsys package output (see script above), hash it, and submit to VirusTotal / your sandbox. Capture SMS/call permission grants and any Device Admin or Accessibility bindings — these tell you the dwell-time impact.

Investigation Scope on Confirmed Infections

Treat a confirmed Corp MDM infection as a credential compromise event, because that is functionally what it is:

• Reset credentials and revoke sessions for any account whose MFA codes may have traversed SMS on the device — TMS/WMS platforms, corporate email, VPN, and any banking/payment applications used by that user.
• Review call-forwarding state on the affected line with your carrier; the call-redirection capability implies forwarding rules may have been configured at the device or carrier level.
• Audit for downstream social engineering: review helpdesk tickets, dispatch changes, and delivery reroute requests during the infection window for signs of attacker-impersonated communications.

Strategic Hardening (This Quarter)

1. Kill SMS-based MFA. This campaign exists specifically to harvest SMS OTPs and redirect verification calls. Migrate logistics platform and IdP authentication to phishing-resistant methods — FIDO2/passkeys, or at minimum TOTP/push via authenticator apps. Every account still on SMS MFA is a standing invitation to this threat class.
2. Deploy Mobile Threat Defense (MTD) — Microsoft Defender for Endpoint on Android, Lookout, Zimperium, or equivalent — integrated into your SIEM so sideloaded packages and risky permission grants generate SOC alerts, not silent exposures.
3. Brand-abuse monitoring: Stand up monitoring for typosquats and fake app-store pages impersonating your brand and your key logistics partners (CEVA, TKW, and your other carriers). Early takedown of distribution pages starves the campaign at the lure stage.
4. User awareness, targeted: Drivers, dispatchers, and warehouse staff should be specifically briefed that the real CEVA/TKW apps are only installed via the genuine Play Store, and that any page prompting an APK download or requesting "Install unknown apps" is hostile.

Vendor & Reporting References

• The Hacker News coverage: https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
• Report confirmed phishing/distribution pages to Google Safe Browsing and the impersonated brands' abuse desks.
• No patch exists for this threat class — the remediation is policy enforcement, eradication of the sideloaded package, and credential rotation.

The uncomfortable lesson here is one we keep relearning in 2026: the mobile fleet is the softest part of most logistics enterprises' attack surface, and attackers know that SMS MFA plus sideloaded apps equals account takeover without ever touching your network perimeter. Close the sideloading path, instrument the devices, and retire SMS as an authentication factor.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub