Published · Updated
A driver needs an app. Dispatch needs an update. The logo looks familiar, and the request feels routine. Before anyone installs it, make sure the app actually came from the vendor it claims to represent.
What researchers found
Research published September 22, 2026, by Have I Been Squatted described Corp MDM, Android malware distributed through imitation Google Play pages using CEVA and TKW Logistics branding. The pages told visitors to download an app outside the official store.
After installation and permission grants, the malware could capture newly arriving text messages and request call forwarding. The analyzed app did not retrieve historical SMS messages. The campaign used copied logistics-company branding to impersonate trusted businesses.
Why this matters beyond one phone
For a small transportation business, a phone may receive login codes, recovery messages, delivery updates, and customer communications.
If an employee installs an unverified app on the phone that receives business login codes, a stolen code could become one part of an account-takeover attempt. Actual access would still depend on the account's other protections and what else the attacker possesses.
That is the real test for an owner: will the team pause to verify an unexpected request when it seems like the fastest way to keep freight moving?
Four practical checks for owners
The goal is not a long mobile-security policy. It is a simple, workable process that drivers, dispatchers, and office staff can follow when a request arrives.
- Keep a short list of approved business apps and where staff should get them. When a new app is requested, confirm it with the vendor using a contact you already have, not a phone number or link in the request.
- Set one stop-and-check rule. An unexpected request to install software, bypass an installation warning, or allow access to texts and calls goes to the designated contact before anyone proceeds.
- Ask your IT provider to show you how company phones prevent unapproved installations, which devices are covered, and where the exceptions are. If personal phones are used for business, agree on a separate policy for them.
- Give the team a chance to practice. An authorized simulated email about a carrier portal or load document can show whether people verify and report the request.
If someone already installed a suspicious app
Stop using that phone for business authentication. From a trusted device, contact your IT or security responder, preserve evidence before cleanup, review affected accounts, revoke exposed sessions, and reset credentials as appropriate.
The original research warns that removing the app may not cancel carrier-side call forwarding. Ask the carrier to independently check for unauthorized diversion.
Related resources
Give your team a safer way to respond
Practice suspicious dispatch, load-document, and carrier-portal requests with a controlled email campaign and follow-up training. Email exercises reinforce verification and reporting; they do not test every step of an app installation.