Date: September 24, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Mobile Security / Cybercrime & Espionage / Supply Chain Defense
Tags: Corp MDM, Android Spyware, Logistics Fraud, AI Malware, Call Forwarding, SMS Theft, MMI Codes
Executive Summary
On September 24, 2026, mobile malware researchers at Have I Been Squatted and The Hacker News published an investigative report uncovering an aggressive cyber campaign targeting the global freight and logistics sector. The threat operation distributes an evasive Android surveillance implant codenamed Corp MDM (com.corp.mdm).
Operating under the banner of the "Global Profit" (also tracked as "MC Profit Always") cybercrime syndicate, the attackers entice commercial drivers, freight dispatchers, and third-party logistics (3PL) brokers via Telegram trucking groups and targeted spear-phishing emails. Victims are lured to typosquatted, high-fidelity clones of the Google Play Store branded after international shipping titans such as CEVA Logistics and TKW Logistics.
Once installed under the guise of an essential corporate Mobile Device Management (MDM) profile, the spyware establishes a covert foothold. Corp MDM is specifically laser-focused on bypassing multi-factor authentication (MFA): it intercepts incoming SMS messages containing one-time passwords (OTPs) and dynamically executes GSM Man-Machine Interface (MMI) dialer codes to redirect voice verification calls to attacker-controlled numbers.
Intriguingly, binary reverse-engineering reveals unmistakable artifacts indicating that Corp MDM was generated with the assistance of artificial intelligence (AI) coding agents, highlighting the growing trend of cybercriminal syndicates leveraging generative AI to rapidly assemble bespoke mobile tooling.
Technical Deep-Dive: Architecture and Exploitation Chain
To analyze how Corp MDM subverts enterprise mobile communications, we examine its delivery pipeline, permissions model, and telemetry routines.+-----------------------------------------------------------------------------------+
| CORP MDM LOGISTICS ATTACK PIPELINE |
|---|
Freight Dispatcher / Driver Spoofed Google Play Store C2 Server (`69.55.61[.]82`)
| | |
| 1. Lured via Telegram/Email | |
| to fake CEVA/TKW portal | |
|------------------------------------>| |
| 2. Downloads APK: `com.corp.mdm` | |
|<------------------------------------| |
| |
| 3. Sideloads & launches app |
| - Prompts for SMS, Telephony, Notifications |
| - Suppresses Launcher Icon (`setComponentEnabledSetting`) |
| - Launches Persistent Foreground Service |
| |
| 4. Registers BroadcastReceiver for: |
| `android.provider.Telephony.SMS_RECEIVED` |
| |
| 5. Intercepts Load Board / Bank OTP SMS: |
| Extracts Sender & Verification Code |
| 6. Exfiltrates SMS payload via HTTP POST |
|-------------------------------------------------------------------------->|
| |
| 7. Receives C2 Command: Divert Voice Calls |
|<--------------------------------------------------------------------------|
| 8. Invokes Intent: `ACTION_CALL` with MMI URI: |
| `tel:*21*
| - Forces Unconditional Call Forwarding! |
| |
| 9. Attacker receives live voice OTP call & hijacks carrier account! |
|<==========================================================================|
1. Delivery & Masquerading Infrastructure
The campaign leverages brand spoofing to bypass user skepticism:
* Typosquatted Landing Pages: The actors configure web servers hosting replica Google Play product pages complete with copied reviews, developer metadata, and CEVA/TKW branding.
* Fake MDM Pretext: Victims are told the application is a mandatory fleet telemetry and compliance tracker required for freight dispatch assignment.
* C2 Centralization: The APK communicates directly with a hardcoded static IP address: 69.55.61[.]82, which simultaneously hosts phishing landing pages and serves secondary Windows infostealer payloads.
2. Permissions & Stealth Mechanics
Upon first execution, Corp MDM requests sensitive permissions:
* RECEIVE_SMS & READ_SMS
* CALL_PHONE & PROCESS_OUTGOING_CALLS
* POST_NOTIFICATIONS & FOREGROUND_SERVICE
Immediately after obtaining permissions, the application hides itself from the device launcher by disabling its primary activity alias via PackageManager:ComponentName componentName = new ComponentName(context, MainActivity.class);
packageManager.setComponentEnabledSetting(
componentName,
PackageManager.COMPONENT_ENABLED_STATE_DISABLED,
PackageManager.DONT_KILL_APP
);
By unregistering the launcher activity, the app disappears from the Android app drawer while its background service continues operating undisturbed.
3. SMS Interception & Exfiltration
Corp MDM registers a high-priority BroadcastReceiver listening for android.provider.Telephony.SMS_RECEIVED. When an incoming SMS arrives from logistics load boards (such as DAT One or Truckstop.com) or banking providers:
1. The receiver extracts the PDU (Protocol Data Unit) arrays.
2. It parses the sender address and message body.
3. It packages the raw SMS content and transmits it via HTTP POST to http://69.55.61[.]82/api/sms/sync.
4. Telephony Hijacking via GSM MMI Codes
In scenarios where enterprise authentication platforms require voice-call verification (or when victims notice missing SMS messages), Corp MDM employs telephony redirection:
* The C2 issues a command containing an attacker-controlled telephone number.
* The malware constructs an Intent.ACTION_CALL containing the standard GSM MMI code for Unconditional Call Forwarding: tel:*21*[attacker_number]#
* When dialed, the cellular network automatically diverts all incoming phone calls directly to the cybercriminal.
* The malware also implements a teardown command (forward_off), issuing tel:##21# to cancel call forwarding once fraudulent transactions have cleared, preventing the victim from prematurely contacting their mobile carrier.
5. Signatures of AI-Assisted Malware Development
Researchers noted peculiar anomalies within Corp MDM's decompiled bytecode:
* LLM Structural Hallmarks: Redundant boilerplate wrappers around standard Android APIs, complete with generic error strings and variable naming patterns typical of code generated by ChatGPT or Claude.
* Implementation Glitches: The presence of unhandled exception boundaries and conflicting logic states that intermittently crash non-critical threads, betraying an author who lacks deep native Android development experience and relied heavily on automated prompting.
Supply Chain Impact: The "Double-Brokering" and Freight Theft Crisis
The targeting of logistics firms is not accidental:
* Cargo Theft & Load Hijacking: Stolen credentials allow threat actors to log into freight brokerage platforms, accept high-value freight shipments (electronics, pharmaceuticals, copper), and assign unauthorized carriers to pick up loads, vanishing with millions of dollars in cargo.
* Double-Brokering Fraud: Attackers intercept legitimate shipping contracts, re-post them on load boards at lower rates, collect payment from the shipper, and leave the physical carrier unpaid.
* Payment Redirection: Armed with intercepted OTPs, actors modify factoring account details in logistics software, diverting hundreds of thousands of dollars in wire payments.
Enterprise Defense & Mitigation Blueprint
Fleet managers, logistics operators, and enterprise security teams must enforce mobile security safeguards immediately.
1. Enforce Strict Mobile Device Management (MDM/EMM) Controls
* Block Sideloading: Disallow user installation of applications from unknown sources. Enforce managed Google Play configurations so employees can only install vetted enterprise apps.
* Device Attestation: Utilize Google Play Protect Integrity API to detect rooted devices, tampered operating systems, and sideloaded APKs.
2. Transition from SMS/Voice OTPs to Phishing-Resistant MFA
* Logistics platforms and transportation portals must deprecate SMS and voice-call verification for administrative actions, password resets, and bank detail updates.
* Mandate FIDO2 / WebAuthn hardware security keys or number-matching authenticator apps for all dispatcher and driver accounts.
3. Telephony & Carrier Safeguards
* Contact cellular enterprise account representatives to restrict or require administrative authorization for MMI-based call forwarding on corporate SIM cards.
* Monitor endpoint telephony logs for outbound calls initiating *21* prefixes.
4. Endpoint Indicators of Compromise (IoCs)
Indicator Type
Value
Package Name
com.corp.mdm
C2 IP Address
69.55.61[.]82
Suspicious URI Scheme
*21* and ##21#
For technical threat intelligence advisories, mobile malware breakdowns, and supply chain cybersecurity analysis, follow Digital Spying.