Type to search across the blog, guides, tools, and services.
↑↓
to navigate
↵
to open
Vulnerability
New Android Spyware Targets Logistics Companies
The Hacker News covered this vulnerability on Sep 24, 2026. Below is a plain-English breakdown of what it is, how it actually works, and whether it matters, written for people who are curious about hacking and security but don't have a technical background.
The Hacker News · Sep 24, 2026
In plain words
Imagine you have a delivery company and someone is secretly reading all your messages and listening to your calls. That's what this spyware does. It's like having a spy in your office who can see everything that's going on.
What's broken
The attackers are using fake websites that look like they belong to real logistics companies to trick people into downloading the spyware. The spyware is disguised as a system service and has the package name com.corp.mdm¹. It can steal new SMS messages and redirect calls.
How it actually works
Here's how it works: the attackers create fake Google Play pages that look like they are from real companies like CEVA and TKW Logistics. When someone downloads the app from these fake pages, they are actually downloading the Corp MDM spyware. This spyware can then connect to the attacker's server and send them the stolen information, like new SMS messages and call logs. The attackers can also use the spyware to redirect calls to a different number. This is possible because the spyware has access to the phone's system services, which allows it to control the phone's functions, like reading SMS messages and making calls.
Terms
¹ com.corp.mdm
, A package name is a unique name that identifies an Android app.
Learn the fundamentals
Want to understand the concepts behind this item? These in-depth HackproofHacks guides explain the
underlying techniques from the ground up.
KeepLooped tracks the newest
offensive-security tools, techniques, vulnerabilities and research from 80+ trusted sources and turns the
most important items into plain-language explainers, so people learning security can keep up without a
technical background. This page summarises and explains the source linked below; it was produced with AI
assistance and is meant as a beginner-friendly starting point. Always confirm specifics, versions, CVE
details, and exploitation status, against the original source and official advisories. Curated and
published by HackproofHacks.