Cybersecurity researchers have flagged a new malware family that’s specifically designed to infect Android-based vehicle head unit firmware developed by DoFun.
Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet.
“The malware spread through the built-in updaters of Android-based automotive head unit firmware,” security researcher Dmitry Kalinin said. “This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.”
The activity has been attributed with high confidence to the MoYu Group, which was outed by the HUMAN Satori Threat Intelligence and Research team last year as part of a broader ad fraud and residential proxy scheme dubbed BADBOX. In July 2025, Google filed a lawsuit against 25 unnamed individuals or entities in China for allegedly operating the BADBOX botnet and its infrastructure.
A car head unit is a central hub that combines multimedia functions with partial control over certain vehicle functions. It can be factory-installed or fitted on older vehicles as part of an aftermarket upgrade. Because Android-powered card head units have become popular across both aftermarket retrofits and factory-built vehicles, a huge chunk of the standard apps, and by extension, malware, can also run on them.
This, in turn, makes them an emerging target for bad actors, as they feature a SIM card slot that enables internet access for navigation and software updates.
“The delivery methods for such malware are becoming highly varied – ranging from pre-installed backdoors to compromised IPTV applications,” Kalinin said in a statement shared with The Hacker News. “In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app.”
Specifically, this involves distributing the malware via the update mechanisms built into the firmware of multiple models of Android-based head units powered by DoFun. Following responsible disclosure, the issue driving the software distribution abuse has been addressed.
The starting point is a legitimate system app called TWCore (“com.tw.core”), which is designed to collect analytics and update the head unit’s software in the form of APK files by making use of a MQTT message broker hosted on the “cardoor[.]cn” subdomain. The APK file is downloaded to the “
The threat actors behind the campaign are said to have weaponized this update channel to deliver previously unknown malware directly to the head units using a dropper dubbed JarService, while taking steps to evade detection. The dropper is responsible for launching a loader that performs the following actions –
- Sends implant information to one of the attackers servers via an HTTP POST request
- Server responds with a link for downloading the next-stage payload (“144.217.243[.]201/vr34der34/dex3.68.png”)
The payload name includes a reference to a version number (“dex3.68”), allowing Kaspersky to retrieve seven distinct variants dating back to “3.57” simply by trying other version numbers.
The attack chain ends with the deployment of the malware as a regular user application. However, it lacks a user interface and covertly operates in the background. It’s configured to send a POST request to the command-and-control (C2) endpoint (“/cpc/api/task”) every 90 minutes by default, along with information about the infected device and its configuration version.
“If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests,” Kaspersky said. “If the configuration version doesn’t need updating, the C2 server instead returns integer command identifiers, which the attackers refer to as productId.”
“The Trojan maps each identifier to command information, which it stores as a serialized JSON object using the SharedPreferences API.”
The malware supports nine commands capable of displaying unwanted advertisements, executing ad fraud, and downloading additional malicious modules. It also allows attackers to receive extensive device information, including display resolution, device model, connected Wi-Fi network identifier, and MAC address. The list of commands is below –
- return, to return a value from SharedPreferences
- copy, to set clipboard contents
- http, to make a POST/GET HTTP request to a specified resource
- web, to open a link in WebView and execute arbitrary JavaScript code within it
- loadlib (not fully implemented)
- loadlib2, to download and execute arbitrary code from an URL
- loadlib3 (not fully implemented)
- deeplink, to open a URL in the browser
- traceroute, to check resource availability via an ICMP ping
The threat actors have been found to leverage “loadlib2” and “http” commands to download “zhima,” a reverse proxy module documented by Nokia Deepfield Emergency Response Team last month and selectively delivered via IPTV apps installed in cheap Android TV boxes.
“Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BADBOX botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide,” Kalinin said.
“This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This serves as a warning that modern automotive platforms urgently require robust protection against malware.”