As reported by The Hacker News, Kaspersky has documented what appears to be the first documented malware campaign specifically targeting Android-based automotive head units through their native update mechanisms. The attribution to MoYu Group — the same actor behind the BADBOX residential proxy and ad fraud operation — signals a deliberate expansion of an already successful criminal enterprise into a new, largely undefended attack surface.

Threat Alert: As reported by The Hacker News, Kaspersky has documented what appears to be the first documented malware campaign specifically targeting Android-based automotive head units through their native update mechanisms.

Why This Matters Beyond the Headlines

The significance here isn't just that cars got malware. It's how they got it. The attackers abused a legitimate system application (TWCore) and its MQTT-based update channel to deliver a dropper called JarService. This is supply chain compromise at the firmware distribution layer — the same class of attack that proved devastating in the SolarWinds and 3CX campaigns, but applied to a device category with almost no endpoint detection or response coverage.

Head units occupy a dangerous blind spot: they're Android devices with SIM cards, persistent internet connectivity, and app installation privileges, yet they lack the security controls that enterprises routinely apply to phones and tablets. No MDM enrollment. No EDR agent. No app allowlisting. For threat actors, this is an unmonitored Linux box sitting in millions of vehicles worldwide.

The BADBOX model has always exploited devices that live outside traditional security perimeters — cheap streaming boxes, IPTV sticks, and now infotainment systems. Defenders need to recognize that the attack surface is wherever connectivity exists, not where IT has visibility.

The Proxy Botnet Economics

The end goal — ad fraud and residential proxy creation — tells us the attackers aren't interested in vehicle safety systems. That's cold comfort. The head unit's SIM connection provides a clean, mobile IP address that's valuable for proxy rotation, credential stuffing, and masking malicious traffic. Each infected vehicle becomes a node in a commercial proxy network, sold to other criminals for fraud, scraping, and evasion.

Google's July 2025 lawsuit against 25 BADBOX operators in China clearly didn't dismantle the infrastructure. MoYu Group's pivot to automotive targets suggests they're diversifying their botnet recruitment channels faster than law enforcement can disrupt them.

Who Is at Risk

The Proxy Botnet Economics
Aftermarket head unit owners: DoFun-powered units are predominantly aftermarket retrofits, meaning consumers who installed third-party infotainment systems in older vehicles are most exposed
Fleet operators: Companies running vehicles with aftermarket Android head units for telematics or driver entertainment face potential compliance and data exposure risks
Factory-equipped vehicles: While this campaign targeted DoFun specifically, the architectural pattern — system app with update privileges over MQTT — exists across multiple Android Automotive implementations
Ad tech ecosystem: The fraud dimension siphons advertising dollars and pollutes attribution data across the broader digital advertising market

Shield53 Recommendations

Immediate Actions

  • Inventory automotive Android devices: Identify any vehicles in your fleet or organization using aftermarket Android head units, particularly DoFun-branded or DoFun-powered firmware. Check for the TWCore application (package name com.tw.core) and inspect the push/apk/ cache directory for unexpected APK files
  • Network-level detection: Monitor for outbound MQTT connections to unfamiliar brokers, especially on non-standard ports. The campaign infrastructure used cardoor[.]cn subdomains — block and alert on any traffic to this domain family
  • Update verification: If you operate or support Android head units, contact the manufacturer to confirm whether the update channel abuse has been patched in your firmware version. DoFun reportedly addressed the issue after responsible disclosure, but firmware distribution to already-deployed units may lag
  • Behavioral indicators: Watch for head units making unexpected outbound HTTP requests, exhibiting high background data usage, or showing signs of proxy service activity (sustained connections to rotating endpoints)

Strategic Actions

  • Extend asset management to automotive IoT: Vehicles with connected infotainment systems are endpoints. Treat them as such in your asset inventory and risk assessments
  • Network segmentation for fleet connectivity: If fleet vehicles connect to corporate networks for syncing or updates, isolate that traffic and apply inspection controls
  • Engage with automotive vendors: Demand transparency about update mechanism security, code signing practices, and broker authentication from head unit manufacturers before procurement
  • Monitor BADBOX infrastructure: Track IOCs from HUMAN Security's Satori team and Kaspersky's report. The proxy network traffic from infected head units will likely appear in abuse feeds and threat intelligence platforms

This campaign is a proof of concept for a much larger problem. As vehicles become software platforms with always-on connectivity, the gap between their attack surface and the security controls applied to them will only widen. The BADBOX operators have recognized this opportunity. The question for defenders is whether we'll close that gap before they scale it.