Corp MDM Spyware Hits Logistics Firms via Fake Google Play Apps

A recent report details how a malicious Android campaign, codenamed Corp MDM, has begun targeting firms in the logistics sector by distributing seemingly innocuous applications through counterfeit Google Play listings. The attackers created two fake store pages—branded “CEVA” and “TKW Logistics”—that appear to be official app pages for shipment‑tracking services ¹. When users download from these sites, they receive an APK packaged under the name com.corp.mdm and claim to function as a system service, giving it elevated privileges on the device ¹.

Once installed, the malware quietly requests broad permissions at install time, including access to SMS messages and phone call logs. It then harvests incoming text messages that often contain one‑time passwords or delivery confirmations, and redirects outgoing calls to preconfigured numbers controlled by the attacker. This dual capability allows the spyware not only to exfiltrate sensitive operational data but also to manipulate communications within the supply chain, potentially causing delays or misrouting of shipments ¹.

Industry experts note that this approach mirrors tactics used by banking trojans such as TrickBot back in 2019, where attackers employed SEO poisoning to make their malicious sites rank higher in search results. By mimicking legitimate logistics apps, Corp MDM exploits the trust that fleet managers place in mobile devices for real‑time tracking. The use of a package name like com.corp.mdm further obfuscates its origin, making manual detection difficult unless the user scrutinizes permission requests before granting them.

From a defensive standpoint, the most effective countermeasure remains vigilance at install time: users should verify that any new application truly originates from Google Play and review requested permissions carefully. For organizations with fleets of Android devices, deploying endpoint protection solutions that flag anomalous SMS traffic patterns and call routing changes could provide early warning signs. Additionally, enforcing least‑privilege policies—restricting apps to only those permissions strictly necessary for shipment tracking—would reduce the attack surface available to future iterations of this spyware.

While no specific number of infected firms has yet been released by the attackers or security researchers, the fact that logistics companies rely heavily on mobile applications for daily operations makes them prime targets. As supply chains become increasingly digitized, the risk of such targeted attacks will likely grow unless industry stakeholders adopt stricter app vetting procedures and invest in robust mobile threat detection tools.