"The malware spread through the built‑in updaters of Android-based automotive head unit firmware," security researcher Dmitry Kalinin said.
Kaspersky discovery, MoYu Group attribution, and the BADBOX link
Kaspersky researchers discovered the campaign in June 2026 and concluded the malware is designed to deliver a multi‑stage downloader that enables ad fraud and the creation of a proxy botnet. The activity was attributed with high confidence to the MoYu Group, an actor HUMAN's Satori Threat Intelligence and Research team previously connected to a broader ad‑fraud and residential proxy operation called BADBOX. The source material notes that Google filed a lawsuit in July 2025 against 25 unnamed individuals or entities in China for allegedly operating the BADBOX botnet and its infrastructure.
Target: Android head units built on DoFun firmware
The malware specifically targets Android‑based vehicle head unit firmware developed by DoFun. The head unit combines multimedia functions and partial control over some vehicle functions and can be factory‑installed or an aftermarket upgrade. Because many standard Android apps — and therefore Android malware — can run on these devices, researchers warned they have become an emerging target. The head units commonly include a SIM‑card slot to provide internet access for navigation and software updates, a capability the attackers exploited in this campaign.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildInfection chain: TWCore, MQTT, JarService and staged payloads
Kaspersky traced the starting point to a legitimate system app named TWCore (package "com.tw.core"), which collects analytics and updates head unit software by downloading APK files via an MQTT message broker hosted on the "cardoor[.]cn" subdomain. APK files are placed under the "/push/apk/" path for installation. According to the report, threat actors weaponized that updater channel and used a dropper named JarService to launch a loader that first POSTed implant information to an attacker server. The server then responded with a link to the next‑stage payload — for example, "144.217.243[.]201/vr34der34/dex3.68.png".
Kaspersky noted the payload naming includes a version string (the example "dex3.68"), which allowed researchers to retrieve seven distinct variants by enumerating version numbers back to "3.57". After the staged download, the final malware is installed as a regular user application without a user interface and runs covertly in the background.
Capabilities: periodic check‑ins, modular commands, and the zhima proxy
The implanted application is configured to POST to the command‑and‑control endpoint "/cpc/api/task" every 90 minutes by default, sending information about the infected device and the configuration version. If the server deems the configuration outdated it returns an updated configuration containing new C2 addresses and new HTTP request paths; otherwise it returns integer command identifiers ("productId") that the Trojan maps to command information and stores as serialized JSON via the SharedPreferences API.
Kaspersky catalogued nine supported commands: return (SharedPreferences value), copy (set clipboard), http (POST/GET to resources), web (open a link in WebView and run arbitrary JavaScript), loadlib (not fully implemented), loadlib2 (download and execute code from a URL), loadlib3 (not fully implemented), deeplink (open a URL in a browser), and traceroute (ICMP ping to check availability). The attackers used loadlib2 and http to retrieve "zhima," a reverse‑proxy module Nokia Deepfield Emergency Response Team documented last month. That module was previously observed delivered selectively via IPTV apps installed on inexpensive Android TV boxes.
What this means for DoFun, security teams, and vehicle owners
- DoFun and device integrators: Kaspersky's disclosure says the abuse exploited legitimate updater functionality; following responsible disclosure, "the issue driving the software distribution abuse has been addressed." Manufacturers and integrators running TWCore‑style update chains will need to confirm that fixes were applied and consider hardening update authentication and broker endpoints such as "cardoor[.]cn".
- Security teams and incident responders: the campaign demonstrates a multi‑stage dropper/loader pattern with versioned payloads (example dex3.68, earlier 3.57) and a lightweight command set that can execute arbitrary code via loadlib2. Responders should look for the periodic /cpc/api/task check‑ins (every 90 minutes) and the presence of background apps without UIs that report device telemetry and configuration versions.
- Vehicle owners and aftermarket buyers: Android‑powered head units — factory or aftermarket — can run standard Android apps and therefore inherit Android threat vectors. The presence of a SIM slot and online update mechanisms provides an attack surface that allows remote delivery of APKs if update channels are compromised.
Conclusion: first documented head‑unit‑specific infection chain, and a continuing risk
Kaspersky framed this as "the first documented case of malware found on a car head unit with an infection chain specific to that type of device," and Dmitry Kalinin warned the delivery methods for such malware are increasingly varied. He also noted that "despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BADBOX botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide." The case shows how legitimate update paths on specialized Android systems can be repurposed for modular ad‑fraud and proxy operations, and it underscores the need for authenticated update pipelines and ongoing monitoring of vehicle head‑unit firmware.
https://thehackernews.com/2026/08/android-car-malware-spreads-through.html
