Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Summary

A new malware family targeting Android-based vehicle head units, specifically those developed by DoFun, has been discovered. The malware spreads through legitimate software update mechanisms, acting as a multi-stage downloader for ad fraud and to establish a proxy botnet. This sophisticated attack chain exploits the TWCore system app and has been attributed to the MoYu Group, previously linked to the BADBOX scheme.

Full text

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet Ravie LakshmananAug 21, 2026Malware / Automotive Security Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of Android-based automotive head unit firmware," security researcher Dmitry Kalinin said. "This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device." The activity has been attributed with high confidence to the MoYu Group, which was outed by the HUMAN Satori Threat Intelligence and Research team last year as part of a broader ad fraud and residential proxy scheme dubbed BADBOX. In July 2025, Google filed a lawsuit against 25 unnamed individuals or entities in China for allegedly operating the BADBOX botnet and its infrastructure. A car head unit is a central hub that combines multimedia functions with partial control over certain vehicle functions. It can be factory-installed or fitted on older vehicles as part of an aftermarket upgrade. Because Android-powered card head units have become popular across both aftermarket retrofits and factory-built vehicles, a huge chunk of the standard apps, and by extension, malware, can also run on them. This, in turn, makes them an emerging target for bad actors, as they feature a SIM card slot that enables internet access for navigation and software updates. "The delivery methods for such malware are becoming highly varied – ranging from pre-installed backdoors to compromised IPTV applications," Kalinin said in a statement shared with The Hacker News. "In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app." Specifically, this involves distributing the malware via the update mechanisms built into the firmware of multiple models of Android-based head units powered by DoFun. Following responsible disclosure, the issue driving the software distribution abuse has been addressed. The starting point is a legitimate system app called TWCore ("com.tw.core"), which is designed to collect analytics and update the head unit's software in the form of APK files by making use of a MQTT message broker hosted on the "cardoor[.]cn" subdomain. The APK file is downloaded to the "<TWCore external cache dir>/push/apk/" path for installation. The threat actors behind the campaign are said to have weaponized this update channel to deliver previously unknown malware directly to the head units using a dropper dubbed JarService, while taking steps to evade detection. The dropper is responsible for launching a loader that performs the following actions - Sends implant information to one of the attackers servers via an HTTP POST requestServer responds with a link for downloading the next-stage payload ("144.217.243[.]201/vr34der34/dex3.68.png") The payload name includes a reference to a version number ("dex3.68"), allowing Kaspersky to retrieve seven distinct variants dating back to "3.57" simply by trying other version numbers. The attack chain ends with the deployment of the malware as a regular user application. However, it lacks a user interface and covertly operates in the background. It's configured to send a POST request to the command-and-control (C2) endpoint ("/cpc/api/task") every 90 minutes by default, along with information about the infected device and its configuration version. "If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests," Kaspersky said. "If the configuration version doesn't need updating, the C2 server instead returns integer command identifiers, which the attackers refer to as productId." "The Trojan maps each identifier to command information, which it stores as a serialized JSON object using the SharedPreferences API." The malware supports nine commands capable of displaying unwanted advertisements, executing ad fraud, and downloading additional malicious modules. It also allows attackers to receive extensive device information, including display resolution, device model, connected Wi-Fi network identifier, and MAC address. The list of commands is below - return, to return a value from SharedPreferences copy, to set clipboard contents http, to make a POST/GET HTTP request to a specified resource web, to open a link in WebView and execute arbitrary JavaScript code within it loadlib (not fully implemented) loadlib2, to download and execute arbitrary code from an URL loadlib3 (not fully implemented) deeplink, to open a URL in the browser traceroute, to check resource availability via an ICMP ping The threat actors have been found to leverage "loadlib2" and "http" commands to download "zhima," a reverse proxy module documented by Nokia Deepfield Emergency Response Team last month and selectively delivered via IPTV apps installed in cheap Android TV boxes. "Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BADBOX botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide," Kalinin said. "This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This serves as a warning that modern automotive platforms urgently require robust protection against malware." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  ad fraud, Android security, Automotive Security, botnet, Cybercrime, Malware, mobile security, Proxy Botnet, Supply Chain Security, Threat Intelligence ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers ⭐ Featured Resources See How to Stop the Bro

Indicators of Compromise

• domain — cardoor[.]cn
• ip — 144.217.243[.]201

Entities