Key Takeaways
- Kaspersky discovered a new malware family in June 2026 that specifically targets Android‑based vehicle head‑unit firmware supplied by DoFun.
- This is the first publicly documented infection chain designed exclusively for automotive head units.
- The threat is attributed with high confidence to the MoYu Group, the same actor behind the BADBOX ad‑fraud and residential‑proxy operation.
- Malware spreads through the legitimate over‑the‑air (OTA) update mechanism of a built‑in system app (TWCore) that uses an MQTT broker to push APK files.
- The attack employs a dropper called JarService, which launches a loader that contacts a C2 server to download a multi‑stage payload (named with version tags such as dex3.68).
- Once installed, the malware runs silently as a background service, checking in with its C2 every ≈ 90 minutes to receive updated configurations or command identifiers.
- It supports nine commands (e.g., http, loadlib2, web, deeplink, traceroute) that enable ad fraud, arbitrary code execution, clipboard manipulation, and network reconnaissance.
- The loadlib2 and http commands are used to fetch and execute zhima, a reverse‑proxy module previously observed in IPTV‑based cheap Android TV boxes, extending the botnet’s reach.
- The discovery highlights an emerging attack surface in modern vehicles and underscores the need for robust code‑signing, update‑verification, and runtime‑integrity protections in automotive head‑unit firmware.
Overview of the Malware Discovery
In June 2026, Kaspersky’s threat‑intelligence team identified a previously unknown malware family that specifically infects Android‑based head‑unit firmware produced by the supplier DoFun. The researchers noted that this represents the first documented case where the infection chain is tailored explicitly for automotive infotainment systems, marking a notable shift in the threat landscape toward connected vehicles. The malware was uncovered during routine monitoring of suspicious OTA update traffic, and Kaspersky promptly issued a responsible disclosure to DoFun, prompting the vendor to patch the abused update mechanism.
Attribution to MoYu Group and BADBOX
Further analysis linked the campaign with high confidence to the MoYu Group, a threat actor previously exposed by the HUMAN Satori Threat Intelligence and Research team as part of the broader BADBOX ad‑fraud and residential‑proxy scheme. In July 2025, Google filed a lawsuit against 25 unnamed Chinese entities allegedly operating the BADBOX botnet and its supporting infrastructure. The MoYu Group’s involvement suggests that the actors are repurposing established fraud‑and‑proxy tools for a new automotive vector, leveraging their existing command‑and‑control (C2) infrastructure to monetize compromised head units.
Why Car Head Units Are Attractive Targets
Modern vehicle head units serve as multimedia hubs that also provide partial control over certain vehicle functions, and they are increasingly built on Android platforms. Because these units often include a SIM‑card slot for navigation, telematics, and software updates, they enjoy persistent internet connectivity—an attractive feature for attackers seeking a reliable conduit for command‑and‑control traffic. The proliferation of both factory‑installed and aftermarket Android head units has created a large, heterogeneous install base, making the platform a lucrative target for malware authors seeking to expand their botnets beyond traditional smartphones and TV boxes.
Delivery Mechanism via Legitimate Updater
The infection begins with a legitimate system app named TWCore (com.tw.core), which is responsible for collecting analytics and delivering firmware updates in the form of APK files. TWCore retrieves updates from an MQTT broker hosted on the subdomain cardoor[.]cn, storing the downloaded APK in the /push/apk/ directory before installation. Threat actors hijacked this trusted update channel by compromising the MQTT server or by publishing malicious APKs under benign filenames, thereby using the head unit’s own OTA mechanism to drop the initial dropper, JarService, without raising suspicion from users or basic integrity checks.
Technical Details of the Dropper JarService
JarService functions as a dropper that, once executed, launches a secondary loader component. The loader’s first action is to send an HTTP POST request to an attacker‑controlled server, transmitting basic implant information (e.g., device model, firmware version). In response, the server returns a URL pointing to the next‑stage payload, exemplified by 144.217.243[.]201/vr34der34/dex3.68.png. The PNG‑like filename includes a version string (dex3.68) that enables the operators to retrieve multiple variants simply by altering the version number; Kaspersky observed seven distinct samples ranging from version 3.57 to 3.68 by iterating through plausible values.
Multi‑stage Payload and Versioning
The payload delivered via the URL above is a dex‑encoded Android application that, despite its image‑like extension, contains executable code. By systematically probing different version numbers in the URL path, researchers were able to reconstruct a timeline of the malware’s evolution, noting incremental changes in obfuscation, command handling, and C2 communication. This version‑based distribution model suggests a mature development pipeline where the threat actors continuously refine the implant while maintaining backward compatibility with existing infected head units.
Behavior of the Final Malware
After installation, the malware masquerades as a regular user application but lacks any visible user interface, operating covertly in the background. It is configured to contact its C2 endpoint (/cpc/api/task) approximately every 90 minutes, transmitting a JSON blob that includes device specifics (display resolution, model, connected Wi‑Fi SSID, MAC address) and a configuration version number. If the C2 determines that the configuration is outdated, it replies with an updated set of C2 addresses and request paths; otherwise, it returns integer identifiers referred to as productId, which the malware maps to specific commands via a serialized JSON object stored in SharedPreferences.
Supported Commands and Their Functions
The Trojan implements nine distinct commands that the C2 can invoke:
return– retrieves a value from SharedPreferences.copy– writes data to the clipboard.http– performs a programmable POST or GET request to an attacker‑specified resource.web– opens a URL inside a WebView and can inject arbitrary JavaScript.loadlib– placeholder (not fully implemented).loadlib2– downloads and executes raw code from a remote URL.loadlib3– placeholder (not fully implemented).deeplink– launches a URL in the device’s default browser.traceroute– sends an ICMP echo to test reachability of a host.
These capabilities enable the attackers to inject ads, manipulate clipboard contents for credential theft, fetch and run additional payloads, and conduct lightweight network reconnaissance—all while remaining invisible to the vehicle’s operator.
Use of loadlib2 and http to Deploy zhima Proxy
Investigators observed that the loadlib2 and http commands are actively used to retrieve and execute a module called zhima, a reverse‑proxy tool first documented by Nokia Deepfield’s Emergency Response Team in relation to IPTV‑based cheap Android TV boxes. By deploying zhima on compromised head units, the MoYu Group can turn each infected vehicle into a node within a residential‑proxy network, routing traffic for ad‑fraud click‑generation, credential‑stuffing attacks, or illicit content distribution. This cross‑platform reuse underscores the attackers’ strategy of maximizing the utility of their existing toolkit across disparate Android‑based devices.
Implications and Recommendations for Automotive Security
The emergence of this head‑unit‑specific malware serves as a stark warning that automotive infotainment systems are no longer immune to sophisticated, financially motivated threats. Manufacturers and suppliers must adopt a defense‑in‑depth approach: enforce strict code‑signing for all OTA packages, implement mutual TLS authentication for update servers, employ runtime integrity checks (e.g., verified boot, SELinux policies), and monitor anomalous outbound connections from head units. Additionally, vehicle owners should be cautioned against installing unverified aftermarket firmware and should apply security patches promptly. As cars become increasingly connected, securing the head‑unit firmware is essential to preserving both driver safety and the broader ecosystem from abuse.