What Happened
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm" Corp MDM
Why It Matters
The report describes Corp MDM, an Android spyware campaign distributed through fake Google Play pages impersonating logistics companies. After installation and permission access, the malware can exfiltrate newly received SMS messages, redirect calls, and maintain a hidden service. RealGround analysis: although the incident does not involve artificial intelligence, its unauthorized collection of potentially sensitive communications is best aligned with the permitted data leakage category; organizations should assess mobile-device controls, application provenance, permission management, and incident-response readiness.
RealGround Analysis
This signal maps to data leakage. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html