ANDROID CAR HEAD UNITS TARGETED IN MALWARE CAMPAIGN LINKED TO BADBOX PROXY BOTNET

August 24, 2026 — Security researchers have identified a malware campaign targeting Android-based automotive head units, using legitimate update functionality to install malicious software without requiring the vehicle owner to click a link, visit a malicious site, or knowingly install an application.

Kaspersky reported that the malware was discovered while monitoring Android threats in June 2026 and described it as the first documented case of malware found on a car head unit with an infection chain specifically designed for that type of device. The affected systems were DoFun Android-based automotive head units used for infotainment and related vehicle functions.

The infection chain centers on TWCore, a legitimate system application installed on the head units. TWCore collects analytics information and handles software updates. Its update mechanism can also download and install Android applications that were not previously present on the device. Kaspersky said attackers abused that capability to distribute malicious software through the head unit’s own update infrastructure.

The first malicious component identified by researchers is JarService, a small dropper application that contains no visible user interface. Because it operates without presenting an icon or normal user-facing screen, a driver could have little indication that the software had been installed.

JarService decrypts and loads additional malicious components. A second-stage loader communicates with attacker-controlled command-and-control infrastructure and retrieves further payloads, creating a multi-stage infection chain that can be changed or expanded remotely.

The third stage gives the attackers substantially greater capability. Kaspersky identified functionality capable of displaying advertisements, generating fraudulent ad activity, making HTTP requests, executing JavaScript through a WebView, downloading additional malicious code, and loading a reverse-proxy component. Researchers said the attackers had implemented at least nine commands at the time of the investigation, although only a subset was observed being actively used.

One of the most important components is a reverse-proxy module identified as zhima. That module can route third-party internet traffic through the compromised automotive device, causing outside activity to appear as though it originated from the internet connection associated with the infected vehicle.

Kaspersky concluded that the ultimate objective of the campaign is the creation of a proxy botnet. Such networks allow criminals or proxy-service customers to route traffic through compromised devices, concealing the true origin of their activity behind legitimate consumer IP addresses.

The threat therefore extends beyond unwanted advertisements or fraudulent clicks. Once an automotive head unit becomes part of a proxy network, its internet connection can potentially be used to carry traffic generated by people elsewhere, while the vehicle owner may remain unaware that the device is functioning as infrastructure for outside activity.

The FBI has separately warned about this broader criminal model. In a June 2025 public-service announcement concerning BADBOX 2.0, the Bureau specifically identified aftermarket vehicle infotainment systems among the Internet-connected devices being compromised and incorporated into botnets and residential-proxy services. The FBI said compromised devices can be used to provide criminals access to legitimate consumer networks and IP addresses.

In March 2026, the FBI issued another warning explaining that residential proxies can help cybercriminals conceal their identities and locations by routing malicious activity through home and small-business internet connections. The Bureau again listed aftermarket vehicle infotainment systems among the Internet of Things devices that can be compromised and recruited into proxy networks.

Kaspersky attributed the current automotive-head-unit campaign with high confidence to MoYu Group, an actor linked to the BADBOX malware ecosystem. Researchers based that assessment on naming patterns found within the malware and significant overlap between the campaign’s network infrastructure and infrastructure previously associated with MoYu Group.

The research also identified connections between the malware infrastructure and services associated with residential-proxy operations. Kaspersky found that one command-and-control address used by the zhima module was connected to an administrative panel associated with proxy infrastructure and observed similarities among multiple proxy-service systems.

BADBOX has previously relied on compromised Android devices and software supply chains to establish large networks of infected hardware. The FBI said the original BADBOX operation involved Android devices containing backdoor malware before purchase, while BADBOX 2.0 expanded the infection model to include malicious applications downloaded from unofficial marketplaces.

The automotive campaign demonstrates another route: abuse of a legitimate system updater already embedded in the device.

That distinction matters because the driver does not necessarily need to install suspicious software or interact with a malicious message. Kaspersky’s telemetry indicated that the malware was installed through the legitimate com.tw.core TWCore application, exploiting the update process built into the head unit itself.

Kaspersky notified DoFun about the distribution mechanism. According to the researchers, the vendor subsequently reported that the security issues had been fixed.

The report does not establish that every DoFun head unit is infected, nor does it indicate that every Android-based automotive system is vulnerable to this specific campaign. The findings concern the infection mechanism and devices observed during Kaspersky’s investigation.

The case does broaden the cybersecurity risk surrounding connected vehicles. Automotive infotainment systems can contain cellular connectivity, Wi-Fi access, Bluetooth, navigation services, application frameworks, and software-update mechanisms. Those capabilities make the head unit another Internet-connected endpoint that must be secured against the same classes of malware and botnet activity already affecting streaming boxes, routers, digital displays, and other IoT devices.

For vehicle owners using Android-based aftermarket head units, the FBI’s broader guidance remains applicable: keep firmware and software updated, examine connected devices for unexplained network activity, avoid unofficial application marketplaces, and investigate hardware that behaves unexpectedly or generates suspicious internet traffic. Anyone who believes a compromised device is being used in criminal activity can report the incident to the FBI’s Internet Crime Complaint Center.

Kaspersky’s findings show that automotive head units are no longer merely theoretical targets for Android malware. Attackers have demonstrated an infection chain capable of abusing a trusted update component, silently delivering additional payloads, enabling fraudulent advertising activity, and turning an internet-connected system inside a vehicle into part of a remotely controlled proxy network.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE