Reported by 3 outlets

Timeline

1. original reporting

   Hackers infect Android car head units with proxy botnet malware

   bleepingcomputer.com · 52d ago · August 22nd, 2026

   A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. Kaspersky researchers analyzed the malware and attributed the operation to the MoYu group, a threat actor previously associated with the BadBox malware botnet . The researchers note that this is the first documented case of a malware infection chain specifically created for the targeted car head unit. MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun is an automotive software, cloud services, and hardware provider that sells generic Android-based head units , which act as the command center for a car's infotainment, navigation, and settings systems. In June, Kaspersky researchers found a rogue APK file being downloaded from a legitimate DoFun system app, TWCore, which receives instructions through an MQTT server hosted at cardoor[.]cn. The unknown app has no interface and is a piece of malware called JarService. When launched, the malware decrypts and executes a second-stage loader that establishes communication with a command-and-control (C2) server and downloads another encrypted payload. The final payload periodically reports device information such as the model, display resolution, Wi-Fi SSID, and MAC address, and retrieves commands from the attackers. The malware supports

2. update from gbhackers.com

   First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet

   gbhackers.com · 50d ago · August 24th, 2026

   A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a residential proxy botnet. The activity, discovered in June 2026, is the first documented malware infection chain purpose-built for automotive head units and has been attributed with high confidence to the MoYu […] The post First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   BADBOX-Linked MoYu Hackers Abuse Android Car Head Unit Updates to Build Proxy Botnet

   cyberpress.org · 50d ago · August 24th, 2026

   The discovery marks a significant escalation as botnet operators expand beyond smartphones, smart TVs, and set-top boxes into in-vehicle infotainment systems, echoing trends seen in other covert malware campaigns infiltrating connected smart hardware. BADBOX-Linked MoYu Hackers Build Android Proxy Botnet While monitoring Android threats in June 2026, researchers flagged a suspicious application that installed like a normal user app but had no user interface whatsoever, a red flag suggesting it was reaching devices without user consent, according to Kaspersky’s Securelist research report . A Boolean flag named installNotExists allows the broker to push and silently install APKs that were never present on the device, completely bypassing the normal update-check logic. Kaspersky notified the vendor, which has since reported fixing the issue. Automotive Head Unit Infection Chain (Image Source: securelist.com) The malware unfolds through a multi-stage architecture.