Android spyware campaign targets logistics firms through fake app pages

A campaign targeting logistics firms is distributing Android spyware through fake Google Play pages branded as CEVA and TKW Logistics, The Hacker News reported, citing research by Have I Been Squatted. The app, called Corp MDM, disguises itself as a system service and asks for access to text messages, calls and notifications. Once installed, it can send newly received text messages to an attacker-controlled server and enable call forwarding. The same infrastructure hosts credential-phishing pages and additional Windows malware aimed at the sector. Corp MDM cannot retrieve messages received before its permissions were granted, and the researchers have not identified the operator.