BADBOX automotive security Android malware ad fraud botnet

Your Car's Infotainment System Is Now a Botnet Node, Apparently

24 August 2026

Kaspersky researchers have discovered a new malware family targeting Android-based car head units, marking the first documented case of malware using an infection chain specifically designed for vehicle systems. The malware, attributed to the MoYu Group, spreads through the legitimate built-in software update mechanism of DoFun firmware, deploying a multi-stage downloader that enables ad fraud and recruits devices into a proxy botnet. The threat highlights the growing security risks posed by internet-connected automotive platforms, as the infected head units' SIM card slots and Android compatibility make them increasingly attractive targets for cybercriminals.

Kaspersky researchers have identified a malware family targeting Android-based vehicle head units, specifically those running firmware developed by a company called DoFun. Discovered in June 2026, the campaign's objectives are depressingly familiar: ad fraud and building out a residential proxy botnet. What makes it notable is the delivery mechanism.

Rather than the usual suspects like trojanised apps or dodgy sideloads, this malware hitched a ride through the legitimate software update channel built into the head unit firmware itself. A system app called TWCore, designed to collect analytics and push APK updates via an MQTT broker, was weaponised to silently deliver a dropper called JarService. From there, a loader fetches the next-stage payload from an attacker-controlled server, and the final malware installs itself as a background app with no UI and no obvious presence. The infected device then checks in with a command-and-control server every 90 minutes, ready to receive instructions.

Kaspersky attributes the campaign with high confidence to the MoYu Group, the same crew the HUMAN Satori team burned last year for running a broader ad fraud and proxy scheme known as BADBOX. Google filed a lawsuit in July 2025 against 25 unnamed Chinese individuals or entities allegedly behind the BADBOX infrastructure, which tells you something about how seriously this is being taken, and also how little that seems to have deterred the people involved.

The malware supports nine commands covering everything from clipboard manipulation and HTTP requests to JavaScript execution via WebView and downloading arbitrary code. Researchers found it actively using two of those commands to deploy a reverse proxy module called 'zhima', previously documented by Nokia's Deepfield Emergency Response Team in the context of cheap Android TV boxes. Same module, new host.

Car head units make an oddly appealing target. They often include a SIM card slot for navigation and OTA updates, they run Android, and they're connected. That means the same malware ecosystem targeting phones and TV sticks can, with minor adaptation, run on the thing bolted into your dashboard. The DoFun firmware issue has apparently been patched following responsible disclosure, though that only helps people whose devices actually receive the fix.

This is the first documented case of malware with an infection chain specifically designed for vehicle head units. It probably won't be the last.

READ NEXT

Google and FBI Knock Out NetNut Proxy Network Backed by Millions of Infected Devices Flying Eagle Android RAT Source Code Leaks, Fingerprints Spotted on 170 Servers NadMesh Botnet Is Raiding Exposed AI Services for Cloud Keys, and the Numbers Don't Add Up