Inside Corp MDM, the Android spyware targeting logistics companies

The report

Source-code analysis of the Corp MDM Android spyware campaign targeting logistics companies through fake Google Play pages, with SMS theft, call forwarding, persistence, C2, and detection details.

Read the full analysis: Inside Corp MDM, the Android spyware targeting logistics companies (Have I Been Squatted).

Indicators

Spyware C

• playgoogle[.]ceva-app[.]help
• playgoogle[.]logisticstkwcargo[.]com

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#1). This page is generated from that record and the report’s own title and summary; nothing is rewritten.