Researchers have uncovered a novel malware family targeting Android-based car head units via their built-in update systems, raising fresh alarms about automotive cybersecurity. The malware—linked with the MoYu Group—utilizes firmware updaters in vehicle infotainment systems to install ad fraud tools and build proxy botnets that can route internet traffic through compromised units. This is the first known case where a car head unit is the entry point for a full infection chain exploiting legitimate system update functionality. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
How the Attack Works
The campaign preys on Android-powered head units made by DoFun, abusing a system application called TWCore responsible for analytics collection and managing firmware updates. TWCore connects to a message broker via the “cardoor[.]cn” subdomain, fetching APK files into a cache folder for automatic installation. Between June 2026 and onward, the firmware’s updater has been repurposed to drop a loader called JarService—initially disguised as part of TWCore’s legit operations. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
Once JarService is deployed, it gathers information about the infected unit and makes an HTTP request to obtain a second-stage payload—typically named in the format “dex3.68.png”—from remote servers. This payload loads a malicious module masqueraded as harmless APK content. Devices infected this way are reconfigured to run the malware in user space without visible UI, communicating with command-and-control (C2) servers every 90 minutes. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
Capabilities and Consequences
The malware supports nine different commands that furnish attackers with granular control: showing ads, conducting ad fraud, downloading additional modules, executing JavaScript in WebView, copying clipboard data, opening URLs, performing HTTP operations, and more. It can also gather hardware details like display resolution, model, connected Wi-Fi, and MAC address. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
This operation ties back to the MoYu Group, already implicated in BADBOX—a botnet that maliciously monetizes devices by creating residential proxies and pushing ads on cheap Android TVs and other devices. While legal pressure from U.S. authorities blunted some BADBOX infrastructure in 2025, the group’s operators continue exploiting overlooked firmware update channels to expand their reach. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
Why Car Systems Are Vulnerable
Modern car head units are quickly becoming soft targets. These infotainment systems often double as multimedia devices, include SIM slots, receive over-the-air updates, and in some cases control essential vehicle functions. Their Android bases make them compatible with many of the same apps—and by extension, malicious payloads—that compromise smartphones. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
The fact that malware was delivered via a component meant to update firmware—an operation trusted by users and manufacturers—shows just how deep of a breach this type of attack represents. The misuse of legitimate system apps for malicious purposes is a hallmark of supply chain–style compromises. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
After private disclosure, the vulnerability enabling this update-based delivery vector has reportedly been patched in affected DoFun devices. ([thehackernews.com](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html))
This incident underscores a growing trend: as vehicles become more connected, the automotive attack surface continues to expand. Owners, manufacturers, and security vendors will need to rethink how firmware is verified, updates are authenticated, and internal systems monitored to prevent misuse. With car head units now confirmed as possible proxies and ad fraud platforms, the stakes have never been higher.
