Android Car Malware Spreads Through Built
Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.
Kaspersky discovered in June 2026 the first documented malware specifically infecting Android-based car head units, spread through the built-in updater (TWCore) of DoFun head unit firmware via a dropper dubbed JarService. The multi-stage implant supports nine commands enabling unwanted ads, ad fraud, and additional module downloads, and installs the zhima reverse proxy module. The campaign is attributed with high confidence to the MoYu Group behind the BADBOX ad fraud and residential proxy scheme; the distribution issue was fixed after responsible disclosure.
- First documented malware with an infection chain tailored to car head units
- Delivered by abusing TWCore updater via MQTT on cardoor[.]cn
- Implant beacons to C2 every 90 minutes with device information
- Linked to BADBOX actors; zhima reverse proxy module deployed
- Infections confirmed in multiple countries, true scale unknown
- Vendors
- Kaspersky
- Threat actors
- MoYu GroupBADBOX
- Malware
- JarService
- Organizations
- GoogleHUMAN Security
- Countries
- Myanmar
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.