A recently disclosed malware campaign has revealed a new attack vector through which attackers are targeting Android-based automotive head units using their built-in software update functionality. The campaign abuses legitimate firmware components to turn connected car infotainment screens into platforms for ad fraud and proxy botnet operations. The malicious code was uncovered by researchers in June 2026. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
How the Infection Works
The attack takes over a system app known as TWCore, which is supposed to manage analytics and head unit firmware updates. Threat actors used an MQTT broker from a domain called “cardoor.cn” to send update instructions. A particular flag—installNotExists—allows TWCore to install applications not originally present on the device, opening the door to the malicious package. Once the malware is placed in TWCore’s update cache, it’s installed under the official package signature of “com.tw.core.” ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
From there, the infection proceeds covertly. Stage one installs “JarService,” which has no visible user interface, decrypts embedded data, and prepares the payload. The second-stage module gathers device-specific information and connects back to a command and control server for further instructions. The third stage intermittently collects metadata such as model, screen resolution, Wi-Fi SSID, and MAC address, then delivers updated configurations or commands as needed. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
Final Payloads and Broader Implications
The threat actors loaded the final payload with capabilities ranging from displaying advertisements, loading webpages in the background, generating fraudulent clicks, to downloading additional malicious modules. Importantly, they also deployed a reverse-proxy component called “zhima,” which allows an infected head unit to relay traffic, turning it into part of a botnet infrastructure. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
The campaign is attributed to the MoYu Group, which has links to the BADBOX actor network. Prior malicious firmware activity from BADBOX had already shown how connected devices—like TVs—could be hijacked. This latest case represents the first documented instance in which the firmware route is specifically used to compromise automotive head units. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
No evidence so far indicates that the malware can interfere with safety-critical systems such as steering or braking. Still, the compromise of infotainment systems raises serious risks around privacy, trust, and network security. A comparable automotive vulnerability—such as flaws in electric vehicle infotainment—has shown how non-critical systems might serve as stepping stones toward deeper access. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
Mitigation and What to Watch For
Vehicle owners are advised to ensure updates come exclusively from authorized manufacturer or dealer sources, verify whether their head unit has received recent security patches, and steer clear of untrusted software or USB sources. Manufacturers should enforce strict validation of update packages, require digital signing, and design systems that allow revoking malicious updates. Monitoring for unexplained app installations or unusual network behavior can help catch attacks early. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
Indicators of Compromise have been published, including multiple SHA-256 hashes of malicious samples (JarService, second- and third-stage loaders, the zhima proxy module), domains like xmsae[.]sbs and cardoor[.]cn, plus command and control infrastructure including IPs such as 144.217.243[.]201. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
As connected vehicles become more common and automotive infotainment systems grow more powerful and networked, these components are no longer just user conveniences—they are potential entry points for malicious actors. This incident underscores the expanding surface of risk in modern vehicles and how trust in firmware and update channels must be rigorously defended. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-infect-android-car-screens/))
