ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Android Automotive OS”

27 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6Exploit / PoC 4Ransomware 4Advisory 2Data breach 1Malware 1
SeverityAllcritical 11high 3medium 4low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.

Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.

The Register · Securityupdated · 1d agofirst · 6d agoExploit / PoC in the wild 23 sourcesCVE-2026-85046CVE-2026-858801

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeek · 6d agoAdvisoryCVE-2026-28662

Android Car Malware Spreads Through Built

Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.

Kaspersky discovered in June 2026 the first documented malware specifically infecting Android-based car head units, spread through the built-in updater (TWCore) of DoFun head unit firmware via a dropper dubbed JarService. The multi-stage implant supports nine commands enabling unwanted ads, ad fraud, and additional module downloads, and installs the zhima reverse proxy module. The campaign is attributed with high confidence to the MoYu Group behind the BADBOX ad fraud and residential proxy scheme; the distribution issue was fixed after responsible disclosure.

The Hacker News · 22d agoMalware in the wild

Android Malware Hijacks Update System for Car Head Units

A click-fraud botnet crew now deploys Android malware to car head-unit infotainment systems by abusing the legitimate software update mechanism.

Threat actors behind a notorious Android click-fraud botnet are targeting vehicle infotainment head units, according to Dark Reading. The malware abuses legitimate update functionality to install and spread infections. The campaign highlights automotive Android systems as an emerging attack surface for established mobile botnet operators.

Dark Reading · 20d agoMalware in the wild

Malware Hijacks Android Car Head Units

Kaspersky reports first known malware infecting Android car head units via firmware updaters, repurposing vehicles as BADBOX proxy nodes for ad fraud.

Kaspersky documented the first known malware infection of Android-based car head units, delivered through the built-in TWCore firmware updater on DoFun devices via an MQTT-driven installation flag. A multi-stage chain installs the JarService dropper and a loader that pulls a clicker and reverse proxy module ('zhima') used for ad fraud and proxy botnet infrastructure. The malware supports nine commands, including clipboard changes, HTTP requests, and JavaScript loading, checking in with C2 every 90 minutes. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BADBOX botnet.

Security Affairs · 25d agoMalware in the wild

Android car head units infected with proxy botnet malware through built-in software updaters

Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.

Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.

Help Net Security · 23d agoMalware in the wild

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading · 13h agoThreat actor in the wild

The invisible passenger in your car

Kaspersky discovered Android adware and proxy-botnet malware delivered inside legitimate DoFun car head-unit software.

Kaspersky researchers uncovered Android malware distributed through legitimate software for DoFun automotive head units. The malware displays ads on infotainment screens and enrolls infected devices into a proxy botnet for resale of residential-style proxy traffic. Delivery via trusted vendor software means victims receive it through a legitimate update channel, raising infection likelihood.

Kaspersky Securelist · 26d agoMalware in the wild

Automobile Camouflage to Hide from Flock Cameras

Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.

The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.

Schneier on Security · 9d agoResearch

Lightweight Zero Trust via Automotive SDN

Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.

Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.

arXiv cs.CR · 7d agoResearch

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.

In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.

The Hacker News · Aug 11, 2026Research

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security Affairs · 26d agoMalware in the wild

JarvisGUI: Towards Cross-Device GUI Agents with Dynamic Task Composition

JarvisGUI benchmark tests GUI agents on cross-device workflows across Android, Windows, and Ubuntu, revealing major gaps in state transfer and long-horizon reasoning.

JarvisGUI is a dynamic benchmark that formulates GUI tasks as input-output transformations under a lightweight type system, automatically composing multi-step cross-device workflows across Android, Windows, and Ubuntu virtual environments. Evaluation shows state-of-the-art open-source GUI agents struggle with state-transfer awareness, cross-platform contextual reasoning, and long-horizon dependency management, exposing a capability gap invisible to existing single-device benchmarks.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

New Agent Tesla Malware Variant Boosts Evasion Capabilities

KnowBe4 documented an Agent Tesla v4 campaign using emoji-based code obfuscation to evade detection.

KnowBe4 researchers reported a campaign distributing Agent Tesla v4, a long-running Windows keylogger and infostealer. The new variant uses emoji-based code obfuscation, a novel technique, to hinder static analysis and evade security tooling. Defenders should watch for behavioral indicators such as credential theft and unusual process activity.

Infosecurity Magazine · 26d agoMalware in the wild

The 12 Best Mobile Device Management (MDM) Solutions, Compared and Priced

A comparison of 12 MDM platforms ranks Microsoft Intune as best value for Microsoft 365 estates and Jamf, Kandji, and Mosyle for Apple fleets.

The buyer's guide compares 12 mobile device management (MDM) products, naming Microsoft Intune best value since it is included in Microsoft 365 E3/E5, and Jamf, Kandji, and Mosyle as Apple specialists with day-one OS support and automated compliance remediation. Eight of the twelve publish rates; per-device pricing punishes multi-device users, while Microsoft, Omnissa, and IBM offer per-user options. Free tiers from Mosyle, Miradore, and ManageEngine support genuine small deployments.

GBHackersupdated · 6d agofirst · 6d agoIndustry 4 sources

New surveillance tech links your phone to your license plate

Researchers show roadside cameras plus Bluetooth signals can link phones to license plates, enabling richer tracking.

Ars Technica reports on new surveillance research showing that combining roadside camera license plate recognition with phone Bluetooth signals can associate specific devices with specific vehicles. The approach could turn existing traffic cameras into far richer tracking tools that follow both a car and its occupant's phone. The work raises significant privacy and civil liberties concerns.

Ars Technica · Security · Aug 11, 2026Research

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.

Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.

The Hacker News · 18d agoAdvisory

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CR · 22h agoResearch

Anthropic's new hardware standard lets AI agents control the physical world

Anthropic announced a standardized hardware driver interface letting AI agents control physical devices and for devices to interoperate.

Anthropic introduced a new hardware standard that provides a standardized driver interface for AI agents to control the physical world. The standard aims to let devices communicate with AI systems and with each other. Details on adoption, partners, or specifications were not included in the available text.

Ars Technica · AI · 19d agoAI industry1

GrapheneOS Overhauled Default Apps and Secure Clipboard

GrapheneOS announced an overhaul of its default apps and a redesigned secure clipboard in its privacy-focused Android distribution.

The GrapheneOS project posted on Mastodon that it has "overhauled default apps and secure clipboard" in its privacy and security hardened Android OS. The provided text contains only the announcement title and engagement figures, without release notes or technical specifics. Changes to built-in apps and clipboard handling in GrapheneOS are typically relevant to Android privacy and mobile security practitioners.

Hacker News · security · 9d agoToolsHN 404↑ · 257 comments

Top 10 Best Patch Management Software in 2026

Roundup ranks 2026 patch management software, favoring Automox, Action1's free tier and Tanium, and warns buyers to vet patching platform security.

This buyer's guide ranks ten patch management tools for 2026, placing Automox first for cloud-native patching, Action1 for a genuinely free small-estate tier and Tanium for patching hundreds of thousands of endpoints. It contextualizes the category with the 2021 Kaseya VSA ransomware supply-chain incident and the 2020 SolarWinds Orion compromise, arguing the security of the patching platform itself must be part of evaluation. It also notes Ivanti products have repeatedly appeared in CISA's Known Exploited Vulnerabilities catalog.

Cyber Security News · 7d agoIndustry

Microsoft Teams for Android Vulnerability Exposes Sensitive Information

Microsoft patched CVE-2026-65812 in Teams for Android, an information-disclosure flaw that can leak credentials under specific conditions.

Microsoft fixed CVE-2026-65812, rated Important, which can insert sensitive information such as credentials into data sent by Microsoft Teams for Android (build 1416/1.0.0.2026133602). Exploitation is remote and low-complexity, requires low privileges plus user interaction, and impact is limited to high confidentiality impact. Microsoft says exploitation is less likely, with no public PoC, disclosure, or in-the-wild exploitation; the fix ships via the Teams app update on Google Play. Ofek Levin of Enclave reported the flaw through coordinated vulnerability disclosure.

Cyber Security News · 7d agoVulnerabilityCVE-2026-658121

How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

Lobsters · security · 5d agoResearch