Cybersecurity experts have identified the first documented malware specifically engineered to infiltrate Android-powered vehicle head units, marking a new frontier in automotive cyber threats. Kaspersky uncovered the threat in June 2026, finding that attackers exploited legitimate software update channels built into head unit firmware developed by DoFun to deliver a multi-stage downloader aimed at ad fraud and proxy botnet creation. Researchers attribute the campaign with high confidence to the MoYu Group, previously linked to the BADBOX botnet scheme that prompted a Google lawsuit against 25 Chinese individuals or entities in July 2025.

The infection begins with a legitimate system application called TWCore, designed to gather analytics and update head unit software via APK files using an MQTT message broker on the "cardoor[.]cn" subdomain. Attackers weaponized this update mechanism to distribute a dropper named JarService, which launches a loader that contacts attacker servers via HTTP POST requests and retrieves next-stage payloads from "144.217.243[.]201/vr34der34/dex3.68.png." By testing different version numbers referenced in payload names, Kaspersky retrieved seven distinct malware variants ranging back to version "3.57." The final-stage malware operates invisibly in the background without a user interface, sending POST requests to command-and-control endpoints every 90 minutes by default along with infected device information and configuration version data.

The malware supports nine distinct commands capable of displaying unwanted ads, executing ad fraud, and downloading additional malicious modules, security researcher Dmitry Kalinin noted. These commands include opening links in WebView to execute arbitrary JavaScript, downloading and executing code from URLs, setting clipboard contents, and checking resource availability via ICMP ping. Attackers leverage these capabilities to harvest extensive device details including display resolution, device model, Wi-Fi network identifiers, and MAC addresses. The threat actors deployed "zhima," a reverse proxy module previously documented by Nokia Deepfield Emergency Response Team in July 2026 and selectively distributed through IPTV apps in budget Android TV boxes.

Android-based car head units have gained popularity in both aftermarket retrofits and factory installations, creating an expanding attack surface because standard Android apps and malware can run on these systems. The devices feature SIM card slots enabling internet connectivity for navigation and software updates, making them attractive targets for malicious actors. According to Kalinin, "Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BADBOX botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide." The researcher emphasized that this malware represents "the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems," warning that modern automotive platforms urgently require robust protection against malware. Following responsible disclosure, DoFun addressed the vulnerability driving the software distribution abuse. The automotive sector now faces a reality where connected vehicle systems demand the same security rigor as consumer electronics, yet the industry's fragmented supply chains and slower patch cycles create persistent exposure windows.