Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
First documented case of malware with an infection chain specifically tailored for Android-based car head units, discovered by Kaspersky in June 2026 Malware spreads by weaponizing the legitimate built-in software update mechanism of DoFun-powered head units via the TWCore system app and an MQTT message broker Attributed with high confidence to the MoYu Group, linked to the BADBOX ad fraud and residential proxy botnet scheme The malware deploys a multi-stage downloader (JarService dropper → load
Analysis
TL;DR
- First documented case of malware with an infection chain specifically tailored for Android-based car head units, discovered by Kaspersky in June 2026
- Malware spreads by weaponizing the legitimate built-in software update mechanism of DoFun-powered head units via the TWCore system app and an MQTT message broker
- Attributed with high confidence to the MoYu Group, linked to the BADBOX ad fraud and residential proxy botnet scheme
- The malware deploys a multi-stage downloader (JarService dropper → loader → payload) that covertly operates in the background to serve ads, execute ad fraud, and build a proxy botnet
- Supports nine commands including ad display, HTTP requests, WebView JavaScript execution, arbitrary code loading, and device information harvesting, with C2 communication every 90 minutes
Why It Matters
This represents a significant escalation in automotive cybersecurity threats, as attackers are now exploiting legitimate firmware update channels on Android-powered vehicle head units — a vector previously unreported for this device class. The convergence of ad fraud and proxy botnet operations on in-car systems highlights how the expanding attack surface of connected vehicles demands urgent, purpose-built security controls rather than generic mobile security approaches.
Technical Details
- Infection vector: The malware exploits the TWCore system app (
com.tw.core), a legitimate analytics and OTA update component that uses an MQTT message broker hosted oncardoor[.]cnto distribute APK updates. Threat actors hijacked this channel to push a malicious dropper called JarService. - Multi-stage payload delivery: JarService launches a loader that contacts an attacker server via HTTP POST, receives a download link for the next-stage payload (e.g.,
dex3.68.png), and deploys the final malware as a background user application with no UI. Seven distinct payload variants were identified (versions 3.57 through 3.68). - C2 communication: The implant sends a POST request to
/cpc/api/taskevery 90 minutes, reporting device info and configuration version. The C2 server responds with either updated C2 addresses/paths or integer command identifiers (productId) mapped to serialized JSON commands stored via SharedPreferences. - Command set: Nine supported commands include
return(SharedPreferences read),copy(clipboard manipulation),http(HTTP GET/POST),web(WebView with arbitrary JS execution),loadlib2(download and execute arbitrary code),deeplink(browser URL opening), andtraceroute(ICMP ping). The malware also downloads the "zhima" reverse proxy module, linking it to the broader BADBOX infrastructure. - Target ecosystem: DoFun-powered Android head units, both factory-installed and aftermarket, which feature SIM card slots for internet connectivity — making them attractive targets due to their always-on network access and growing market prevalence.
Industry Insight
- Automotive OEMs and head unit firmware vendors must treat software update mechanisms as critical security boundaries; the abuse of legitimate OTA channels demonstrates that supply chain trust assumptions are insufficient without cryptographic verification and integrity checks on update payloads.
- The persistence of BADBOX-affiliated actors despite law enforcement actions and botnet takedowns signals that ad fraud and proxy botnet operations are highly resilient and adaptive — security teams should expect continued diversification of infection vectors into IoT and embedded device categories.
- The emergence of car head units as a new malware target underscores the need for automotive-specific threat modeling and security frameworks that account for the unique constraints of in-vehicle Android systems, including limited patching capabilities, long device lifecycles, and the potential for physical-world impact from compromised systems.
Disclaimer: The above content is generated by AI and is for reference only.