{"id":2492,"date":"2026-08-21T17:53:13","date_gmt":"2026-08-21T17:53:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2492"},"modified":"2026-08-21T17:53:13","modified_gmt":"2026-08-21T17:53:13","slug":"android-car-malware-spreads-through-built-in-updaters-for-ad-fraud-proxy-botnet","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2492","title":{"rendered":"Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 21, 2026<\/span><\/span>Malware \/ Automotive Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have flagged a new malware family that’s specifically designed to infect Android-based vehicle head unit firmware developed by DoFun.<\/p>\n

Kaspersky, which discovered<\/a> the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet.<\/p>\n

\u00abThe malware spread through the built-in updaters of Android-based automotive head unit firmware,\u00bb security researcher Dmitry Kalinin said. \u00abThis is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.\u00bb<\/p>\n

The activity has been attributed with high confidence to the MoYu Group, which was outed by the HUMAN Satori Threat Intelligence and Research team last year as part of a broader ad fraud and residential proxy scheme dubbed BADBOX. In July 2025, Google filed a lawsuit against 25 unnamed individuals or entities in China for allegedly operating the BADBOX botnet and its infrastructure.<\/p>\n

A car head unit is a central hub that combines multimedia functions with partial control over certain vehicle functions. It can be factory-installed or fitted on older vehicles as part of an aftermarket upgrade. Because Android-powered card head units have become popular<\/a> across both aftermarket retrofits and factory-built vehicles, a huge chunk of the standard apps, and by extension, malware, can also run on them.<\/p>\n

This, in turn, makes them an emerging target for bad actors, as they feature a SIM card slot that enables internet access for navigation and software updates.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe delivery methods for such malware are becoming highly varied \u2013 ranging from pre-installed backdoors to compromised IPTV applications,\u00bb Kalinin said in a statement shared with The Hacker News. \u00abIn this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app.\u00bb<\/p>\n

<\/p>\n

Specifically, this involves distributing the malware via the update mechanisms built into the firmware of multiple models of Android-based head units powered by DoFun. Following responsible disclosure, the issue driving the software distribution abuse has been addressed.<\/p>\n

The starting point is a legitimate system app called TWCore (\u00abcom.tw.core\u00bb), which is designed to collect analytics and update the head unit’s software in the form of APK files by making use of a MQTT message broker hosted on the \u00abcardoor[.]cn\u00bb subdomain. The APK file is downloaded to the \u00ab\/push\/apk\/\u00bb path for installation.<\/twcore><\/p>\n

The threat actors behind the campaign are said to have weaponized this update channel to deliver previously unknown malware directly to the head units using a dropper dubbed JarService, while taking steps to evade detection. The dropper is responsible for launching a loader that performs the following actions –<\/p>\n

\"\"<\/a><\/div>\n