MEDIUM Malware #Malware #Android #Ad Fraud

Android Car Head Unit Malware Spreads via Built-In Updaters

2026-08-22 16:13 UTC 2 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Android-based vehicle head units are being infected via legitimate firmware update mechanisms to facilitate ad fraud and proxy botnet operations.
Affected systems: Android automotive head unit firmware developed by DoFun and utilizing the TWCore system application.
Remediation: Apply firmware updates provided by manufacturers to secure built-in update channels and monitor vehicle network traffic for malicious proxy connections.

Security researchers have identified a novel malware family targeting Android-based automotive head units, marking the first documented instance of malware explicitly tailored to infect in-vehicle infotainment systems through a specialized infection chain. According to The Hacker News, the campaign was uncovered by Kaspersky in June 2026 and has been attributed to actors associated with the MoYu Group, known for prior involvement in the BADBOX residential proxy and ad fraud ecosystem.

Technical Analysis of Android Head Unit Infection Vectors

The attack abuses the legitimate software update mechanism of Android-based head units powered by DoFun firmware. Specifically, the infection vector leverages a built-in system application called TWCore (com.tw.core), which manages analytics collection and software updates via APK files. This application communicates with an MQTT message broker hosted on the cardoor[.]cn subdomain to fetch updates.

Attackers weaponized this communication channel to push a dropper known as JarService directly to the external cache directory (<TWCore external cache dir>/push/apk/). The dropper deploys a multi-stage loader, with variants indexed by version numbers such as dex3.68. Once installed, the payload runs as a background service without a user interface.

Key capabilities of the deployed malware include:

Sending regular HTTP POST requests to a command-and-control (C2) endpoint (/cpc/api/task) every 90 minutes.
Exfiltrating device metrics, including display resolution, device model, connected Wi-Fi SSID, and MAC address.
Processing nine distinct operational commands mapped via the SharedPreferences API to execute ad fraud, display unwanted advertisements, and download additional modules.
Leveraging loadlib2 and http commands to download zhima, a reverse proxy module previously linked to cheap Android TV boxes.

Actionable Recommendations and Mitigations

Automotive platforms and aftermarket head units frequently lack traditional endpoint detection and response tooling, making prevention critical. Security teams and vehicle owners should prioritise the following measures:

Firmware Updates: Ensure head units are running the latest patched firmware from the manufacturer to close vulnerabilities abused in update delivery channels.
Network Monitoring: Inspect outbound traffic from automotive head units for anomalous connections to unknown MQTT brokers or recurring HTTP POST requests indicative of C2 beacons.
Application Auditing: Restrict the sideloading of third-party applications on vehicle infotainment systems and review installed packages for unknown background services.

#Malware #Android #Ad Fraud #Botnet

X/Twitter LinkedIn Reddit HN

← Back to Articles