Malware Hijacks Android Car Head Units
Kaspersky reports first known malware infecting Android car head units via firmware updaters, repurposing vehicles as BADBOX proxy nodes for ad fraud.
Kaspersky documented the first known malware infection of Android-based car head units, delivered through the built-in TWCore firmware updater on DoFun devices via an MQTT-driven installation flag. A multi-stage chain installs the JarService dropper and a loader that pulls a clicker and reverse proxy module ('zhima') used for ad fraud and proxy botnet infrastructure. The malware supports nine commands, including clipboard changes, HTTP requests, and JavaScript loading, checking in with C2 every 90 minutes. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BADBOX botnet.
- First documented malware infection of Android car head units, spread via built-in firmware updater
- Legitimate TWCore system app abused via MQTT config flag to silently install dropper JarService
- Final stage is a clicker and reverse proxy ('zhima') supporting ad fraud and proxy botnet use
- Attributed with high confidence to MoYu Group, tied to BADBOX botnet infrastructure
- Products
- TWCore
- Threat actors
- MoYu Group
- Malware
- BADBOX
- Organizations
- Kaspersky
From the original article
5 min read at securityaffairs.com
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.