Loading story…
A newly identified malware family has been infecting Android-based vehicle head units built on DoFun firmware by abusing the devices’ built-in software update mechanism. Kaspersky said the campaign, attributed to the MoYu Group and linked to prior BADBOX activity, is the first documented malware infection chain tailored specifically for car head units. The attackers abuse the legitimate TWCore system app to deliver a dropper named JarService, which launches a loader that reaches out to command-and-control infrastructure for additional payloads.
The malware is designed to monetize compromised in-car systems through ad fraud while also turning them into a proxy botnet. Reported capabilities include displaying ads, downloading additional malware, collecting device information, and deploying the reverse proxy module zhima. Supporting indicators tied to the activity include suspicious Android package names, rotating .sbs domains, IP addresses, APK delivery URLs, and infrastructure associated with proxy services and payload hosting under cardoor[.]cn, indicating a broader Android malware ecosystem behind the operation.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
A third APK download URL listed in the indicator reference is dated 2026-06-08 under ovcloudcontrol.cdn.cardoor[.]cn, tying the delivery infrastructure to activity in June 2026.
Kaspersky discovered a malware family targeting Android-based vehicle head unit firmware developed by DoFun. The malware spreads through built-in firmware updaters and is described as the first documented infection chain tailored specifically for car head units.
The indicator-only reference includes another APK download URL under ovcloudcontrol.cdn.cardoor[.]cn dated 2025-06-10, showing continued use of the same delivery infrastructure.
One reference lists an APK download URL under ovcloudcontrol.cdn.cardoor[.]cn that is dated 2024-11-07, indicating malware-related payload hosting infrastructure was active by that date.
After responsible disclosure by Kaspersky, DoFun stated that it had fixed the issue affecting its Android-based car head unit firmware. This is the first explicit vendor remediation/response event described in the timeline.
The activity targeting DoFun Android car head units was attributed to the MoYu Group, which had previously been linked to the BADBOX botnet. Reported capabilities included ad fraud, additional malware delivery, device information collection, and deployment of the zhima reverse proxy module.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 72 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecyberveille.ch
Open sourcetherecord.media
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the first documented Android malware campaign targeting automotive head units, after attackers abused the legitimate update mechanism of the `TWCore` system app on DoFun devices to deliver a multi-stage infection chain. The campaign used a stage-1 dropper known as **JarService**, followed by a stage-2 loader and a stage-3 payload that enabled ad-click fraud and deployed the **zhima** reverse-proxy module. Kaspersky said the operation was discovered in June 2026 and that DoFun later fixed the security issues that allowed the malicious updates to be distributed. The activity was attributed with high confidence to **MoYu Group**, an actor tied to the broader **BADBOX** ecosystem previously linked to large-scale fraud operations on consumer Android devices. HUMAN Security's reporting on **BADBOX 2.0** described a botnet monetizing infected devices through multiple schemes, including ad fraud and proxy abuse, aligning with the tactics seen in the automotive infections. The overlap in infrastructure and naming suggests the operators extended BADBOX-style monetization from consumer electronics into internet-connected vehicles, creating a new foothold inside Android-based in-car systems.
Aug 24, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Researchers reported **Keenadu**, a multi-stage Android backdoor implanted **during the firmware build process** by linking a malicious static library into `libandroid_runtime.so`, then **injecting into the Zygote process** so its code is mapped into every app at launch—behavior that mirrors the earlier **Triada** firmware compromise seen in counterfeit devices. The backdoor has been observed across multiple device brands (including tablets) and in several cases the compromised firmware was delivered via **OTA updates**, giving operators broad, persistent access at the system level. Technical analysis indicates Keenadu modifies runtime behavior to decrypt and execute additional components, loading payloads dynamically (e.g., via `DexClassLoader`) and using a client/server-style architecture on-device to enable remote control and data access. Intercepted modules were tailored to the victim’s installed apps and included capabilities such as **browser search hijacking**, **install/monetization fraud**, and stealthy interaction with advertising elements; reporting also notes distribution pathways involving **apps on Google Play** and links between at least one Keenadu payload and code found embedded in numerous standalone apps, suggesting a broader ecosystem of related Android botnet activity.
Jun 29, 2026