Android Malware in Car Head Units: Vehicles Become Gig-Economy…

Kaspersky discovered in June 2026 a new Android malware family that infects DoFun automotive head units through their built-in TWCore firmware updater. Compromised devices are converted into ad-fraud and residential proxy botnet nodes, attributed to the MoYu Group, an actor linked to the BADBOX ecosystem. This is the first documented case of infection with a compromise chain specifically designed for vehicle infotainment systems.

Kaspersky discovered in June 2026 a new Android malware family that infects DoFun automotive head units through their built-in firmware update mechanism. Compromised devices are converted into nodes for ad fraud and residential proxy botnets, with attribution to the MoYu Group, an actor linked to the BADBOX ecosystem. This is the first documented case of infection with a compromise chain specifically designed for vehicle infotainment systems.

Key Takeaways

The vector is the legitimate TWCore updater (com.tw.core), which receives commands via MQTT from the domain cardoor[.]cn to install apps not originally present on the device
The JarService dropper launches a multi-stage chain with seven retrieved payload variants (versions 3.57–3.68) and C2 requests every 90 minutes
The zhima module turns head units into reverse proxies, with infrastructural overlap independently confirmed on TV boxes by Nokia Deepfield
DoFun serves over 30 million vehicle owners; Kaspersky notified the vendor, which reported having fixed the security issues

How the TWCore Updater Becomes the Infection Vector

The malware exploits a legitimate update mechanism to infiltrate without any user interaction. TWCore, a system app on DoFun head units, uses an MQTT broker on cardoor[.]cn to receive deployment instructions. The installNotExists field allows installation of APKs not originally present on the device: attackers used this functionality to deliver the JarService dropper.

The APK file is downloaded to the <TWCore external cache dir>/push/apk/ directory and installed silently. Kaspersky telemetry shows JarService in that path, with com.tw.core as the installing package. This mechanism makes the compromise invisible to the user, who sees no permission requests or installation notifications.

The chain continues with a loader that contacts command-and-control servers. The payloads, identified in seven distinct versions from 3.57 to 3.68, contain XOR-encrypted blocks with serialized data; the entry point is the wa method of the com.c.j.qbh class. The latest configuration version observed is 3.82.

From Dropper to Proxy: The Multi-Stage Payload Path

The final payload sends POST requests to the /cpc/api/task endpoint every 90 minutes, transmitting information about the compromised device. C2 commands retrieved from analysis include: return (base response), http (POST/GET execution), web (WebView load with arbitrary JavaScript), loadlib2 (download and execute code from URL), and traceroute (network diagnostics).

The web command enables JavaScript injection into an invisible WebView, functionality used for ad fraud activity: the device simulates ad views and user interactions without the driver's awareness. The loadlib2 command is used to download the zhima module, which converts the head unit into a reverse proxy.

The C2 infrastructure shows links to admin.uipoxy[.]com, a domain hosting an administration panel for residential proxy services. Associated registration pages present documents typical of commercial proxy providers, indicating a structured monetization model: vehicle devices, always on and with 4G/5G connectivity, offer low-latency, high-reliability bandwidth for customers paying for geographic anonymity.

Attribution to the MoYu Group and the BADBOX Ecosystem

Kaspersky attributes the activity to the MoYu Group with high confidence. The assessment rests on three convergences: naming artifacts in the malicious code, structural similarities with software documented on set-top boxes, and substantial overlap in network infrastructure. HUMAN Security, in separate analysis, identified MoYu Group as the developer of the BADBOX 2.0 backdoor and operator of the PXYEDGE and ProxyForU proxy services.

The BADBOX 2.0 operation, according to HUMAN, compromised over one million consumer devices across 222 countries and territories. Among these are vehicle infotainment units, confirming that MoYu Group's reach extends beyond traditional home IoT devices. HUMAN collaborated with Google and Shadowserver for infrastructure disruption, reporting the adoption of techniques mapped in the MITRE ATT&CK framework.

"This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device." — Dmitry Kalinin, Kaspersky

Why Automotive Platforms Inherit IoT Fragilities

The DoFun case exemplifies a critical transition in the threat landscape: Android automotive platforms inherit the same supply-chain vulnerabilities that have characterized consumer IoT devices. Head units are not smartphones with a larger screen: they run Android Open Source Project versions often lacking Google Play Protect certification, with vendor-controlled update mechanisms and limited visibility for the end user.

Constant connectivity and guaranteed power from the vehicle make head units attractive targets for operations requiring persistence and stable bandwidth. Unlike a smartphone that powers off or leaves the network, a parked vehicle keeps the infotainment system active for hours, providing operational continuity to botnet operators.

The exact number of compromised head units in the specific campaign is not quantified in the sources. No precise geography of infections emerges: Kaspersky telemetry does not detail locations, and the campaign start date remains undetermined, although version 3.57 suggests activity prior to discovery. The extent of economic losses generated by ad fraud and the proxy botnet on these specific devices is not stated.

What to Do Now

Verify device certification: aftermarket or Chinese-brand Android head units often run AOSP builds without Play Protect; Google certification is an indicator of hardened update mechanisms
Monitor anomalous mobile data consumption: C2 traffic every 90 minutes and proxy activity generate sustained upload patterns visible in carrier statistics
Check for undocumented system apps: JarService and TWCore operate without a user interface, but ADB analysis tools can reveal suspicious packages with SYSTEM permissions
Request confirmation of receipt and installation of the fix from the vendor: Kaspersky notified DoFun, which reported corrections, but independent verification of actual distribution is not available

Frequently Asked Questions

Can the malware compromise the vehicle's active safety systems?

No. DoFun head units manage infotainment functions and partially vehicle commands, but not safety-critical systems such as brakes, steering, or airbags. The brief documents no escalation toward primary vehicle buses.

Are all Android head units vulnerable?

No. The specific issue concerns DoFun firmware and its TWCore mechanism. Other automotive vendors with different update systems are not necessarily affected, although the supply-chain logic is transferable.

Is a CVE available for this vulnerability?

No source mentions a CVE assigned for the TWCore update mechanism. The infection vector is described as abuse of legitimate functionality rather than exploitation of a software vulnerability in the classic sense.

The automotive sector is learning that infotainment is not a peripheral accessory but a full-fledged network node. The criminal gig economy understood before many manufacturers that the connected vehicle offers resources — bandwidth, power, persistence — difficult to replicate with traditional infrastructure. The difference between a compromised TV box and an infected head unit is that the latter travels with the owner, crosses borders, and changes cellular networks seamlessly. For residential proxy operators, it's added value; for device security, a complication.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references