Corp MDM Android spyware (HIBS 22 Sep): fake Play pages for CEVA/TKW logistics; SMS theft + call divert
Have I Been Squatted (published 22 September 2026; researcher Ben Folland) documents Corp MDM, a compact Android surveillance implant distributed via fake Google Play pages branded as CEVA and TKW Logistics (playgoogle.logisticstkwcargo[.]com / playgoogle.ceva-app[.]help) delivering package com.corp.mdm. Once sideloaded it requests SMS/telephony/notification permissions, removes its launcher icon, runs a hidden foreground service, registers a device id with C2, heartbeats ~30s, and polls for commands (intercept new inbound SMS only — not the historical inbox — enable/disable call forwarding, self-destroy). C2 and phishing/Windows-malware hosting share VPS 69.55.61[.]82; operator panel on TCP/3456. HIBS assesses Armenian/Russian nexus from panel/UI artefacts and places the implant inside a broader logistics-sector credential-phishing + Windows malware campaign aimed at cargo theft (distinct from prior Diesel Vortex cluster; no evidence same group). Suspected AI-assisted development (capability-limiting bugs). No CVE. Wire: The Hacker News 24 Sep 2026. Primary: HIBS research post.
- Product
- Android Corp MDM spyware (com.corp.mdm) via fake Google Play lures impersonating CEVA / TKW Logistics
- Versions
- n/a (malicious APK; self-signed CN=Corp MDM cert validity from 3 Jun 2026; SHA-256 fingerprint 29f0f6c51fda728b91aaa299cf14758f01d7d83e941a549e26b8fbf2eb70fc42 per HIBS)
- Exploited in Australia?
- unknown
- Patch to
- Do not sideload APKs from non-Play domains; block/hunt 69.55.61.82 and playgoogle.logisticstkwcargo.com / playgoogle.ceva-app.help; revoke SMS/call permissions on unknown MDM-named apps; logistics staff: treat unexpected Play-lookalike install prompts as hostile
Primary: Have I Been Squatted — Inside Corp MDM (22 Sep 2026; note vendor URL spelling) · Vendor: Have I Been Squatted — Corp MDM analysis · The Hacker News — Corp MDM spyware targets logistics (24 Sep 2026)