Loading story…
Researchers reported the first documented Android malware campaign targeting automotive head units, after attackers abused the legitimate update mechanism of the TWCore system app on DoFun devices to deliver a multi-stage infection chain. The campaign used a stage-1 dropper known as JarService, followed by a stage-2 loader and a stage-3 payload that enabled ad-click fraud and deployed the zhima reverse-proxy module. Kaspersky said the operation was discovered in June 2026 and that DoFun later fixed the security issues that allowed the malicious updates to be distributed.
The activity was attributed with high confidence to MoYu Group, an actor tied to the broader BADBOX ecosystem previously linked to large-scale fraud operations on consumer Android devices. HUMAN Security's reporting on BADBOX 2.0 described a botnet monetizing infected devices through multiple schemes, including ad fraud and proxy abuse, aligning with the tactics seen in the automotive infections. The overlap in infrastructure and naming suggests the operators extended BADBOX-style monetization from consumer electronics into internet-connected vehicles, creating a new foothold inside Android-based in-car systems.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published a Securelist analysis detailing the multi-stage Android malware campaign targeting automotive head units, including the TWCore abuse chain, malware stages, and reverse-proxy/ad-fraud functionality. The report also disclosed infrastructure, URLs, domains, and file hash indicators associated with the activity.
Researchers identified a new multi-stage Android malware campaign in June 2026 targeting Android-based automotive head units for ad fraud and proxy botnet activity. The malware was distributed through the legitimate TWCore update mechanism on DoFun head units.
HUMAN Security published a report on BADBOX 2.0 describing the disruption of a campaign targeting consumer devices with multiple fraud schemes.
After being notified about the distribution scheme affecting its head units, DoFun reported that it had fixed the security issues that enabled the malware delivery path.
Researchers attributed the automotive head-unit malware activity with high confidence to MoYu Group based on naming overlaps and shared infrastructure. The actor was described as linked to the BADBOX botnet.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 66 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcecyberveille.ch
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourcehumansecurity.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly identified malware family has been infecting Android-based vehicle head units built on DoFun firmware by abusing the devices’ built-in software update mechanism. Kaspersky said the campaign, attributed to the **MoYu Group** and linked to prior **BADBOX** activity, is the first documented malware infection chain tailored specifically for car head units. The attackers abuse the legitimate **TWCore** system app to deliver a dropper named **JarService**, which launches a loader that reaches out to command-and-control infrastructure for additional payloads. The malware is designed to monetize compromised in-car systems through **ad fraud** while also turning them into a **proxy botnet**. Reported capabilities include displaying ads, downloading additional malware, collecting device information, and deploying the reverse proxy module **`zhima`**. Supporting indicators tied to the activity include suspicious Android package names, rotating `.sbs` domains, IP addresses, APK delivery URLs, and infrastructure associated with proxy services and payload hosting under `cardoor[.]cn`, indicating a broader Android malware ecosystem behind the operation.
Aug 25, 2026
Researchers and independent analysts linked a large Android supply-chain botnet known as **BADBOX** to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than **190,000** compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as **Yandex 4K QLED TVs** and the **Hisense/Instawall T963**. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.
Aug 21, 2026
Finnish authorities warned that some Android smart devices sold to consumers, particularly televisions, TV boxes, and other home-networked endpoints, have been found with **BadBox 2.0** malware already present before purchase. The malware has been linked especially to low-cost products from lesser-known manufacturers and can also spread through malicious apps and suspicious websites. Officials said the backdoor may be inserted during the production chain, turning affected devices into covert criminal infrastructure while they continue to appear to function normally. BadBox 2.0 allows attackers to remotely load additional modules, collect data, and abuse infected devices for operations including botnet activity and denial-of-service attacks. The malware is considered especially hard to detect and effectively impossible for users to remove because the backdoor resides in firmware that cannot be rewritten without manufacturer support. Estonia's Information System Authority reported more than **7,000** infected devices in the country, underscoring the broader supply-chain security problem. Finland's Cyber Security Centre urged consumers to disconnect suspected devices immediately, install official vendor updates if available, and stop using and dispose of devices if the manufacturer does not provide a fix.
Jun 29, 2026