As reported by SecurityAffairs, Kaspersky researchers have documented what appears to be the first known malware infection targeting Android-based car head units, delivered through the vehicle's own official firmware update mechanism. The malware converts infotainment systems into nodes for the BADBOX proxy botnet — a campaign previously associated with low-cost Android streaming devices. This is a meaningful escalation, and it deserves more attention than it's likely to get.

Threat Alert: As reported by SecurityAffairs, Kaspersky researchers have documented what appears to be the first known malware infection targeting Android-based car head units, delivered through the vehicle's own official firmware update mechanism.

Why This Matters Beyond the Headline

The automotive industry has spent years debating the security of over-the-air (OTA) update mechanisms, but most of that conversation has centered on critical driving systems — brakes, steering, engine control. Infotainment head units have been treated as lower-risk targets. This campaign demonstrates why that assumption is dangerous. The head unit is a networked Android computer with persistent connectivity, a power source that's reliably available whenever the vehicle is parked, and increasingly, access to vehicle data buses. That makes it an ideal residential proxy node — exactly what BADBOX operators want.

The attackers didn't need to exploit a vulnerability. They abused a legitimate update channel by manipulating a configuration flag within TWCore, the analytics and firmware management app on DoFun head units. The installNotExists parameter effectively turned a routine update pipeline into a silent APK installation mechanism.

This is supply-chain compromise at the update-layer, not a traditional vulnerability. There may be no CVE to patch. The weakness is architectural: an MQTT broker instructing a system app to download and install arbitrary packages with insufficient integrity verification.

Who Is Affected

Who Is Affected
DoFun head unit owners — directly impacted as their vehicles become proxy nodes for ad fraud and potentially other criminal traffic.
Other Android head unit manufacturers — the TWCore pattern is unlikely to be unique to DoFun. Any vendor using a similar push-based update architecture with weak package validation faces the same exposure.
Fleet operators — vehicles used as unwitting proxy nodes may generate anomalous network traffic, potentially triggering abuse complaints or IP blocklisting that affects legitimate business connectivity.
Automakers broadly — this establishes a proof-of-concept that vehicle infotainment systems are viable botnet infrastructure, which will attract attention from other threat actors.

Broader Implications

BADBOX's expansion from cheap TV boxes to automotive platforms signals that threat actors are actively mapping the Android ecosystem for new device categories with always-on connectivity and weak update security. The residential proxy market is lucrative — these nodes are sold to other criminals for ad fraud, credential stuffing, scraping, and potentially as obfuscation layers for more serious crimes. A vehicle-based proxy is especially valuable because its IP address rotates geographically and is associated with a consumer ISP, making traffic appear more legitimate than datacenter proxies.

There's also a legal and regulatory dimension. Under regulations like UNECE R155 and the EU Cyber Resilience Act, automakers face obligations around update security and post-market vulnerability management. A compromised update channel is precisely the scenario these frameworks were designed to address.

What Defenders Should Do

For Automotive OEMs and Tier-1 Suppliers

  • Audit update architectures immediately. Any system where a remote service can instruct a head unit to install APKs needs code signing, server-side authentication, and client-side integrity verification. The MQTT-driven push model described here is a red flag.
  • Implement allowlisting. Head units should only execute packages signed by the OEM or authorized partners. Unknown signatures should be blocked at the OS level, not merely warned about.
  • Monitor telemetry for anomalies. Sudden outbound traffic from head units to unknown endpoints, especially SOCKS or HTTP proxy traffic, should trigger alerting.
  • Review configuration flags. Any parameter like installNotExists that alters installation behavior should require authenticated, signed commands — not plaintext MQTT messages.

For Fleet and Enterprise Security Teams

  • Include vehicle head units in asset inventories where connected vehicles are part of the fleet.
  • Monitor egress traffic from vehicle Wi-Fi hotspots for proxy-protocol signatures.
  • Engage OEM vendors to confirm update security posture and request SBOMs for infotainment firmware.

For Consumers

  • Check for firmware updates from your vehicle manufacturer and install them promptly.
  • Watch for unusual behavior: head units running hot when the vehicle is off, unexpected data usage on connected vehicle plans, or sluggish infotainment performance.
  • If you own a vehicle with a DoFun head unit, contact the manufacturer or dealership to ask about security patches.

Shield53 Assessment

This is not a one-off incident. It's a template. The combination of Android flexibility, push-based update mechanisms, and weak package authentication exists across the automotive infotainment ecosystem. We expect to see copycat campaigns targeting other head unit vendors within 6-12 months. OEMs that haven't already hardened their update pipelines should treat this as a fire drill, not a curiosity. The cost of signing infrastructure and server-side authentication is trivial compared to the reputational and regulatory cost of vehicles being used as criminal infrastructure.