Key Takeaways
- Kaspersky identified the first known malware targeting Android‑based car head units, discovered on an aftermarket infotainment system from Chinese vendor DoFun.
- Attackers abused a vulnerability in the system’s software‑update distribution channel to push malicious Android applications that act as droppers, loaders, clickers, and reverse‑proxy loaders.
- The malware supports nine commands, but observed activity focused on downloading a reverse‑proxy module, indicating the primary aim is to enroll devices into a proxy botnet.
- Evidence links the malware to the MoYu Group, which is associated with the BadBox botnet—a large‑scale operation that has compromised over 10 million Android devices, mainly TV boxes, since at least 2023.
- The emergence of vehicle‑infotainment targeting shows BadBox operators diversifying their infection vectors beyond budget consumer electronics.
- DoFun has patched the reported vulnerability after notification, but the incident underscores the need for hardened update mechanisms and vigilant monitoring of automotive‑grade Android systems.
Overview of Discovery
Researchers at Kaspersky uncovered what appears to be the first malware specifically designed to infect car head units. The malicious code was found on an Android‑powered aftermarket infotainment system manufactured by the Chinese company DoFun, a product that enjoys widespread use across China and other APAC markets. The detection came during routine telemetry analysis, where anomalous network traffic and unfamiliar package signatures raised red flags. Subsequent reverse‑engineering confirmed that the software was not a benign update or a legitimate app, but a purpose‑built threat targeting the vehicle’s multimedia platform.
Malware Discovery and Targeted System
The infected head unit runs a customized Android build that provides access to the vehicle’s audio, navigation, and sometimes vehicle‑control interfaces via Android APIs. Because the system is exposed to the internet for over‑the‑air (OTA) updates, it presents an attractive attack surface for threat actors seeking persistent footholds in moving vehicles. Kaspersky’s analysis revealed that the malware was packaged as a set of seemingly innocuous Android applications that were signed with a certificate matching those used by DoFun’s official update service, thereby evading basic integrity checks.
Exploit Mechanism and Update Channel Abuse
The attackers exploited a weakness in the DoFun OTA update infrastructure. By compromising the update distribution server—or by performing a man‑in‑the‑middle attack on the communication channel—they were able to push malicious payloads masquerading as legitimate firmware or app updates. Once the head unit downloaded and installed the tampered package, the malware gained execution privileges equivalent to a regular system app, allowing it to register boot‑receivers, hide its icon, and establish persistence across reboots without user interaction.
Malware Functionality and Components
The delivered payload comprises several modular components, each serving a distinct role in the infection chain. A dropper first extracts and installs a loader, which then decrypted and executed additional modules. Among these modules are a clicker designed to generate fraudulent ad‑revenue by simulating user interactions with advertisements, and a reverse‑proxy loader that turns the infected device into a relay node for malicious traffic. The modular design enables the threat actors to swap or update functionality remotely, maintaining flexibility while keeping the core infection stealthy.
Observed Command Set and Proxy Botnet Goal
Kaspersky analysts identified that the malware implements a command‑and‑control (C2) interface supporting nine distinct instructions. These include commands to display ads, trigger click‑fraud actions, download supplementary modules, and activate the reverse‑proxy capability. However, in the wild, the researchers have only observed the issuance of commands to download and activate the reverse‑proxy module. This selective use suggests that the primary objective of the campaign is to conscript the head units into a proxy botnet, which can be leveraged for activities such as credential stuffing, distributed denial‑of‑service (DDoS) attacks, or masking the origin of illicit traffic.
Link to MoYu Group and BadBox Botnet
Through code‑reuse analysis, overlapping C2 infrastructure, and shared behavioral patterns, Kaspersky attributes the malware to the MoYu Group—a threat actor collective previously tied to the development and operation of the BadBox botnet. BadBox first emerged in 2023 as a large‑scale Android‑based botnet that monetizes compromised devices through ad fraud, click‑fraud, and proxy services. The group’s known tooling, including specific packer routines and obfuscation techniques, matches those found in the head‑unit malware, reinforcing the attribution.
BadBox History and Scale
Since its inception, BadBox has grown exponentially despite intermittent law‑enforcement takedowns and industry countermeasures. In 2023, Google filed a lawsuit against the operators of BadBox 2.0, alleging that the botnet had ensnared more than ten million Android devices, predominantly low‑cost TV boxes and streaming sticks. The botnet’s revenue model relies heavily on generating fraudulent ad impressions and selling proxy access, making the expansion into automotive infotainment a logical step to increase the pool of exploitable devices and diversify infection vectors.
Expansion to Vehicle Infotainment
Traditionally, BadBox operators have focused on compromising budget consumer electronics that often ship with outdated or insecure Android builds. The successful infiltration of a car head unit demonstrates that the group is actively probing new delivery channels, exploiting OTA update mechanisms that are common across many modern vehicles. This shift not only broadens the potential impact—given the increasing connectivity of automobiles—but also raises safety concerns, as compromised infotainment systems could, in theory, be used as a stepping stone to reach more critical vehicular networks.
Implications and Mitigation
The discovery serves as a stark reminder that any Android‑based device with OTA update capabilities is a potential target for sophisticated botnet operators. Manufacturers must enforce strict code‑signing verification, employ end‑to‑end encryption for update channels, and implement robust anomaly detection to spot unauthorized payloads. End users and fleet managers should apply vendor‑provided patches promptly—DoFun has already addressed the disclosed vulnerability after being notified—and consider isolating infotainment systems from critical vehicle networks where possible. Additionally, security monitoring solutions should be adapted to detect the characteristic traffic patterns of reverse‑proxy modules, even when they appear on non‑traditional endpoints like car head units.
Outlook
As vehicles become increasingly software‑defined, the attack surface will continue to expand, attracting threat actors seeking lucrative, long‑term footholds. The emergence of head‑unit‑targeted malware linked to BadBox signals a new frontier in mobile‑device‑centric cybercrime. Continued collaboration between automotive OEMs, software suppliers, and cybersecurity firms will be essential to harden update mechanisms, share threat intelligence, and protect both the privacy and safety of drivers and passengers worldwide.