Kaspersky finds malware abuse of Android car head-unit updaters
Kaspersky has identified what it calls the first documented malware infection chain designed specifically for Android-based vehicle head units. The campaign abused built-in update mechanisms in firmware developed by DoFun to deliver a multi-stage downloader used for ad fraud and a proxy botnet.
Kaspersky discovered the activity in June 2026 and attributes it with high confidence to the MoYu Group, an actor linked to the BADBOX ad-fraud and residential-proxy operation. The company said the software distribution issue that enabled the abuse was addressed after responsible disclosure.
A legitimate updater became the delivery route
The entry point was TWCore, a legitimate system application with the package name com.tw.core. It collects analytics and updates head-unit software as APK files through an MQTT message broker hosted on the cardoor[.]cn subdomain. Downloaded packages are placed in the application’s external cache directory for installation.
Attackers weaponized that channel to push an unknown dropper called JarService directly to multiple DoFun-powered head-unit models. The dropper launches a loader, sends information about the implant to an attacker-controlled server through an HTTP POST request, and receives a link for the next-stage payload.
The payload naming scheme included a configuration-like version reference, dex3.68. By testing other version numbers, Kaspersky retrieved seven distinct variants dating back to version 3.57. The final malware is installed as a normal user application, has no interface and runs covertly in the background.
Commands support fraud, data collection and proxy delivery
By default, the malware contacts its command-and-control endpoint every 90 minutes, sending device information and its configuration version. If that configuration is outdated, the server supplies updated command-and-control addresses and HTTP request paths. Otherwise, it returns command identifiers that the Trojan maps to serialized JSON command data stored with Android’s SharedPreferences API.
The implant supports nine commands. These include showing unwanted advertisements, making HTTP requests, opening links in WebView and executing arbitrary JavaScript, downloading and executing code, setting clipboard contents, opening browser URLs and testing resource availability with ICMP ping. It can also collect display resolution, device model, connected Wi-Fi identifier and MAC address.
Kaspersky observed the operators using the loadlib2 and http commands to obtain zhima, a reverse-proxy module previously documented in IPTV applications on low-cost Android TV boxes. The pattern extends the ecosystem described in automotive Android malware delivery paths into automotive Android systems, where internet connectivity for navigation and updates can also expose a valuable delivery path.
Implications for connected-vehicle deployments
A car head unit combines multimedia capabilities with partial control of vehicle functions, and Android models are used both in factory vehicles and aftermarket upgrades. Their SIM-card support enables navigation and software updates, while also giving malware a route to communicate externally.
For businesses deploying, servicing or supplying connected vehicles, the practical implication is to treat head-unit update infrastructure as a security-critical supply-chain component: verify update-channel controls, assess installed system applications and ensure supplier remediation is tracked when distribution mechanisms are abused.