# Android Car Head Unit Malware Spreads via Built-In Updaters

> Kaspersky discovered a new malware family targeting Android car head units via DoFun firmware updaters to build an ad fraud and proxy botnet.

- Published: 2026-08-22T16:13:11.000Z
- Severity: medium
- Category: Malware
- Tags: Malware, Android, Ad Fraud, Botnet
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/android-car-malware-spreads-through.html
- Canonical: https://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updaters

## Key points

- Immediate impact: Android-based vehicle head units are being infected via legitimate firmware update mechanisms to facilitate ad fraud and proxy botnet operations.
- Affected systems: Android automotive head unit firmware developed by DoFun and utilizing the TWCore system application.
- Remediation: Apply firmware updates provided by manufacturers to secure built-in update channels and monitor vehicle network traffic for malicious proxy connections.

Security researchers have identified a novel [malware](/glossary#malware) family targeting Android-based automotive head units, marking the first documented instance of malware explicitly tailored to infect in-vehicle infotainment systems through a specialized infection chain. According to [The Hacker News](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html), the campaign was uncovered by Kaspersky in June 2026 and has been attributed to actors associated with the MoYu Group, known for prior involvement in the BADBOX residential proxy and ad fraud ecosystem.

## Technical Analysis of Android Head Unit Infection Vectors

The attack abuses the legitimate software update mechanism of Android-based head units powered by DoFun [firmware](/glossary#firmware). Specifically, the infection vector leverages a built-in system application called `TWCore` (`com.tw.core`), which manages analytics collection and software updates via APK files. This application communicates with an MQTT message broker hosted on the `cardoor[.]cn` subdomain to fetch updates.

Attackers weaponized this communication channel to push a dropper known as `JarService` directly to the external cache directory (`<TWCore external cache dir>/push/apk/`). The dropper deploys a multi-stage loader, with variants indexed by version numbers such as `dex3.68`. Once installed, the [payload](/glossary#payload) runs as a background service without a user interface.

Key capabilities of the deployed malware include:
- Sending regular HTTP POST requests to a command-and-control ([C2](/glossary#c2)) [endpoint](/glossary#endpoint) (`/cpc/api/task`) every 90 minutes.
- Exfiltrating device metrics, including display resolution, device model, connected Wi-Fi SSID, and MAC address.
- Processing nine distinct operational commands mapped via the `SharedPreferences` [API](/glossary#api) to execute ad fraud, display unwanted advertisements, and download additional modules.
- Leveraging `loadlib2` and `http` commands to download `zhima`, a reverse proxy module previously linked to cheap Android TV boxes.

## Actionable Recommendations and Mitigations

Automotive platforms and aftermarket head units frequently lack traditional endpoint detection and response tooling, making prevention critical. Security teams and vehicle owners should prioritise the following measures:

- **Firmware Updates:** Ensure head units are running the latest patched firmware from the manufacturer to close vulnerabilities abused in update delivery channels.
- **Network Monitoring:** Inspect outbound traffic from automotive head units for anomalous connections to unknown MQTT brokers or recurring HTTP POST requests indicative of C2 beacons.
- **Application Auditing:** Restrict the sideloading of third-party applications on vehicle infotainment systems and review installed packages for unknown background services.

**Related:** [Aeternum Botnet Leverages Polygon Blockchain for Resilient C2](/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2), [HalluSquatting: AI Coding Assistants Tricked into Botnet Malware](/blog/hallusquatting-ai-coding-assistants-tricked-into-botnet-malware)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updaters