Malware Hijacks Android Car Head Units via Firmware Updaters

A newly identified malware family has been infecting Android-based vehicle head units built on DoFun firmware by abusing the devices’ built-in software update mechanism. Kaspersky said the campaign, attributed to the MoYu Group and linked to prior BADBOX activity, is the first documented malware infection chain tailored specifically for car head units. The attackers abuse the legitimate TWCore system app to deliver a dropper named JarService, which launches a loader that reaches out to command-and-control infrastructure for additional payloads.

The malware is designed to monetize compromised in-car systems through ad fraud while also turning them into a proxy botnet. Reported capabilities include displaying ads, downloading additional malware, collecting device information, and deploying the reverse proxy module zhima. Supporting indicators tied to the activity include suspicious Android package names, rotating .sbs domains, IP addresses, APK delivery URLs, and infrastructure associated with proxy services and payload hosting under cardoor[.]cn, indicating a broader Android malware ecosystem behind the operation.