Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
Corp MDM malware targets logistics firms, stealing SMS and redirecting calls via fake Google Play pages.
Corp MDM malware targets logistics firms, stealing SMS content and redirecting calls through fake Google Play pages.
- Corp MDM Android spyware targets logistics firms, stealing SMS and redirecting calls
- Threat actor uses AI during development and targets via credential phishing and Windows malware
- Products
- Corp MDM
- Threat actors
- Armenian or Russian threat actor
- Malware
- Corp MDM
- Victims
- Logistics firms
- Organizations
- Logistics firms
- AI models
- OpenAI agents
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ceva-app.help | ch as below - playgoogle.logisticstkwcargo[.]com playgoogle.ceva-app[.]help Both the artifacts use a hard-coded IP address ("69.55.61 |
| domain | logisticstkwcargo.com | ia bogus Google Play Store pages such as below - playgoogle.logisticstkwcargo[.]com playgoogle.ceva-app[.]help Both the artifacts use a hard- |
| ipv4 | 69.55.61.82 | app[.]help Both the artifacts use a hard-coded IP address ("69.55.61[.]82") for command-and-control (C2), as well as for hosting cr |
From the original article
3 min read at thehackernews.com
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.