BADBOX-Linked Malware Infected Android Car Head Units for Ad Fraud and Proxying

Researchers reported the first documented Android malware campaign targeting automotive head units, after attackers abused the legitimate update mechanism of the TWCore system app on DoFun devices to deliver a multi-stage infection chain. The campaign used a stage-1 dropper known as JarService, followed by a stage-2 loader and a stage-3 payload that enabled ad-click fraud and deployed the zhima reverse-proxy module. Kaspersky said the operation was discovered in June 2026 and that DoFun later fixed the security issues that allowed the malicious updates to be distributed.

The activity was attributed with high confidence to MoYu Group, an actor tied to the broader BADBOX ecosystem previously linked to large-scale fraud operations on consumer Android devices. HUMAN Security's reporting on BADBOX 2.0 described a botnet monetizing infected devices through multiple schemes, including ad fraud and proxy abuse, aligning with the tactics seen in the automotive infections. The overlap in infrastructure and naming suggests the operators extended BADBOX-style monetization from consumer electronics into internet-connected vehicles, creating a new foothold inside Android-based in-car systems.