Loading story…
A logistics-focused campaign is distributing the Android spyware Corp MDM through counterfeit Google Play pages impersonating CEVA and TKW Logistics. Installed as com.corp.mdm, the implant steals newly received SMS messages, can activate call forwarding, hides its launcher, and persists in the background. Its command-and-control server, 69.55.61[.]82, also hosted credential-phishing pages, Windows malware, and a password-protected panel used to administer compromised devices.
The operator has not been identified, but localized administration-panel and source-code artifacts indicate possible Armenian or Russian ties. The activity overlaps thematically with the previously documented Diesel Vortex freight-focused phishing operation, which stole more than 1,600 logistics-platform credentials and used Russian-language development artifacts alongside Armenian-language Telegram coordination; however, no confirmed attribution or operational link to Corp MDM has been established. Logistics organizations should review Android device enrollment and SMS/call-forwarding permissions, block the identified infrastructure, and warn users against app downloads from links or non-official Play listings.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers documented Corp MDM, an Android spyware campaign targeting logistics firms through fake Google Play pages impersonating CEVA and TKW Logistics. The implant steals newly received SMS messages, can enable call forwarding, hides its launcher, and communicates with command-and-control infrastructure at 69.55.61[.]82; the operator remains unidentified.
Google Threat Intelligence Group, Cloudflare, GitLab, IPInfo, Ping Identity, Microsoft Threat Intelligence Center, CrowdStrike, and victim-notification partners participated in a coordinated disruption of the Diesel Vortex infrastructure.
Have I Been Squatted and Ctrl-Alt-Intel uncovered the operation and designated it Diesel Vortex after recovering an exposed Git repository and platform data. The recovered environment showed Russian-language development artifacts and Armenian-language Telegram coordination.
A SQL dump dated February 4 documented detailed activity from the phishing platform, including credential-capture activity and 35 check-fraud attempts.
The original GlobalProfit panel domain was suspended about 17 days after registration, prompting the operators to migrate to successor panel domains.
The Diesel Vortex operators registered the original GlobalProfit administration-panel domain, globalprofit-lpanel-abcdefghij.top.
The financially motivated Diesel Vortex operation began targeting freight and logistics companies in the United States and Europe, ultimately stealing credentials from more than 1,600 users of logistics platforms.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcereddit.com
Open sourcehaveibeensquatted.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026
Threat actors have increasingly adopted sophisticated techniques to distribute Android malware by disguising malicious applications as legitimate ones on the Google Play Store and other platforms. Notably, the new Cellik Android RAT has been identified as turning legitimate Google Play apps into surveillance tools, enabling attackers to covertly monitor and exfiltrate sensitive user data. In parallel, operations involving the Wonderland SMS stealer have merged dropper, SMS theft, and RAT capabilities at scale, with attackers using fake Google Play Store pages, ad campaigns, and messaging apps to propagate malware, particularly targeting users in Uzbekistan. These campaigns often leverage Telegram for coordination and distribution, and employ advanced methods such as intercepting OTPs and exfiltrating contact lists to facilitate financial theft and evade detection. The evolution of Android malware now includes the use of droppers that appear harmless but deploy malicious payloads locally after installation, even without an active internet connection. The Wonderland malware, attributed to the TrickyWonders group, demonstrates bidirectional command-and-control communication, allowing real-time execution of commands and theft of SMS messages. The convergence of these techniques highlights a growing trend in mobile threat operations, where attackers exploit the trust in legitimate app platforms and social engineering to compromise devices, steal credentials, and siphon funds from victims' bank accounts.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026