Kaspersky researchers have uncovered a supply-chain attack targeting Android-based car head units that uses a legitimate device-update app to spread proxy botnet malware. The operation, attributed to the MoYu threat actor group, marks the first documented case of a malware infection chain built specifically for automotive head units.
What Happened: MoYu Group Infects Android Car Head Units via DoFun Update App
In June 2026, Kaspersky found a rogue APK file being distributed through a legitimate DoFun system application called TWCore. DoFun, owned by Shenzhen Driving Control Technology Co., Ltd., is a Chinese automotive software and hardware provider that sells generic Android-based head units for vehicle infotainment, navigation, and settings systems.
The TWCore app normally receives instructions through an MQTT server hosted at cardoor[.]cn. However, attackers had compromised this update channel to push a malicious, interface-less application named JarService. When launched, JarService decrypts and executes a second-stage loader. Consequently, this loader establishes communication with a command-and-control (C2) server and downloads an additional encrypted payload.
Kaspersky attributed this operation to the MoYu group, a threat actor previously linked to the BadBox malware botnet. Moreover, the researchers emphasized that this is the first documented malware infection chain specifically created for targeted car head units.
Technical Details of the JarService Malware
The JarService malware operates as a multi-stage payload delivery system. It first reports device information back to its operators, including the model, display resolution, Wi-Fi SSID, and MAC address. After registration, the infected head unit enters a command-processing loop to retrieve and execute attacker instructions.
The malware supports nine distinct commands:
- return — Retrieves a specified value from Android’s SharedPreferences storage
- copy — Copies stored or downloaded content to the device clipboard
- http — Sends HTTP GET or POST requests and can save part of the response
- web — Opens a URL in a WebView and executes supplied JavaScript
- loadlib — Not fully implemented when Kaspersky published the report
- loadlib2 — Downloads and executes arbitrary code or additional modules
- loadlib3 — Not fully implemented when Kaspersky published the report
- deeplink — Opens a specified resource in the browser
- traceroute — Checks whether specified hosts are reachable using ICMP ping
Researchers discovered that the primary payload loaded by operators is a reverse-proxy module named “zhima.” Therefore, infected head units are converted into residential proxy botnet nodes. In addition, the malware performs web requests for click-fraud activity.
Business and Operational Impact
The compromise of Android car head units presents several business and operational concerns for both consumers and fleet operators:
- Privacy Exposure: Compromised devices expose Wi-Fi SSIDs, MAC addresses, and other device metadata that can aid in geolocation and network profiling.
- Proxy Abuse: Residential proxies sourced from vehicles can mask malicious traffic, making IP-based threat intelligence less effective for defenders.
- Ad Fraud Revenue: Click-fraud operations monetize infected devices, funding further attacker infrastructure.
- Supply-Chain Erosion: Trust in automotive software update channels is undermined, affecting consumer confidence and aftermarket device markets.
Fortunately, Kaspersky confirmed the malware does not interfere with driving or critical vehicle control systems. However, the precedent of automotive infotainment systems being used as monetization infrastructure raises broader concerns for connected vehicle security.
Mitigation and Recommendations
Immediate Actions for Vehicle Owners and Fleet Operators
- Audit installed Android applications on aftermarket head units and remove any unknown or suspicious APKs.
- Review network traffic logs for outbound connections to cardoor[.]cn or other unknown MQTT endpoints.
- Disable automatic updates from unverified sources until the vendor confirms channel integrity.
Actions for Automotive Software Providers
DoFun stated it resolved the problem after Kaspersky notified the company. Therefore, other automotive software providers should treat this incident as a supply-chain security wake-up call. Furthermore, they should implement code-signing verification for all over-the-air updates and monitor update channels for unauthorized package injection.
Actions for Security Teams
- Treat residential proxy traffic from known mobile and IoT IP ranges with heightened scrutiny.
- Correlate proxy botnet indicators with threat intelligence on MoYu and BadBox infrastructure.
- Educate users about the risks of aftermarket connected devices that lack robust update security.
Bottom line: The MoYu group’s car head unit campaign demonstrates that attackers will monetize any internet-connected device. Consequently, automotive infotainment systems are now firmly in the crosshairs. Vehicle owners and fleet operators should audit aftermarket head units immediately, while automotive vendors must harden update channels before this tactic spreads to other manufacturers.
Incident Summary
| Incident Name: | MoYu Android Car Head Unit Proxy Botnet |
| Affected Systems: | DoFun Android-based aftermarket car head units via TWCore app |
| Disclosure Date: | August 22, 2026 |
| Threat Actor: | MoYu group (linked to BadBox botnet) |
| Malware Family: | JarService (primary), zhima reverse-proxy module |
| Primary Impact: | Residential proxy botnet, ad fraud |
| Patch Status: | DoFun reports problem resolved; no CVE assigned |
References
- BleepingComputer, “Hackers infect Android car head units with proxy botnet malware,” August 22, 2026, https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/
- Kaspersky Securelist, “Android head unit malware,” August 2026, https://securelist.com/android-head-unit-malware/121106/
- BleepingComputer, “Google sues to disrupt BadBox 2.0 botnet infecting 10 million devices,” February 2025, https://www.bleepingcomputer.com/news/security/google-sues-to-disrupt-badbox-20-botnet-infecting-10-million-devices/
