By ByteBot
Kaspersky disclosed this week the first documented Android car head unit malware campaign — an attack built specifically around automotive infotainment systems. The malware, named JarService, is attributed with high confidence to MoYu Group, the same operators behind the BADBOX botnet that Google sued in July 2025 over more than ten million compromised Android TV boxes and tablets. The attack abuses a legitimate firmware update app to silently enroll car dashboards as nodes in a residential proxy botnet and ad fraud network. Kaspersky researcher Dmitry Kalinin discovered it in June 2026; the full technical disclosure dropped August 21.
This isn’t a Hollywood car hacking story. MoYu Group doesn’t want your steering wheel — they want your car’s LTE connection.
How the TWCore Firmware Attack Works
The infection vector is a legitimate DoFun system application called TWCore, which handles analytics and software updates on DoFun brand head units via an MQTT message broker. TWCore supports an installNotExists flag in its MQTT messages — a configuration option that allows installing applications not originally present on the device. Attackers flipped that flag to push JarService directly through DoFun’s own CDN infrastructure, requiring zero user interaction.
JarService is a multi-stage dropper with no visible UI. It uses XOR-encrypted payload blocks to obscure its contents, decrypts and loads a malicious loader, which then phones home to attacker-controlled servers with device identifiers, model information, and network details. The loader fetches the final payload: a clicker and reverse proxy component that checks in with command-and-control infrastructure every 90 minutes. Kaspersky tracked the malware across versions 3.57 through 3.82, with the earliest download path dated November 2024 — this campaign ran quietly for at least a year and a half before disclosure.
Related: Rust arrayref Attack: Cargo Build Executes Malware Today — another supply chain attack using a trusted toolchain as the delivery mechanism.
Your Dashboard, Their Proxy
The primary payload is a module called zhima — a reverse proxy that converts the car’s internet connection into a residential proxy node. Kaspersky found links between the zhima infrastructure and commercial residential proxy services PXYEDGE and ProxyForU. The admin panel at admin.uipoxy[.]com resolves to a zhima command-and-control IP, suggesting the operators are reselling access to compromised automotive connections as proxy exit nodes. Secondary capability: ad fraud via a clicker module that simulates ad impressions from what appears to be a legitimate consumer device.
The modular command framework supports nine distinct operations — clipboard manipulation, WebView JavaScript injection, HTTP requests, arbitrary code download and execution, and more. The car isn’t just a botnet node; it’s flexible remote infrastructure that MoYu Group can repurpose at any time.
BADBOX Botnet Expands to Car Head Units
MoYu Group has a documented history of targeting cheap Android devices that share three traits: Android OS, always-on internet, and no security tooling. They started with Android TV boxes and tablets. Google filed suit in July 2025 after the BADBOX 2.0 campaign compromised more than ten million devices. Nokia’s Deepfield team independently confirmed the same malware family on set-top boxes running parallel to the automotive campaign.
Cars are a natural next target. Aftermarket Android head units sold on AliExpress and Amazon for $50–$200 are architecturally nearly identical to the cheap Android TV boxes BADBOX previously targeted — same uncertified AOSP builds, same absence of Google Play Protect, same MQTT-driven update patterns. Kaspersky put it plainly: MoYu Group keeps changing how it spreads the malware and is moving into new types of devices. The automotive sector just found out what that means.
Are You at Risk?
Only DoFun brand native Android head units are confirmed affected, and DoFun has reportedly patched the TWCore vulnerability following Kaspersky’s responsible disclosure. However, if you have any aftermarket Android head unit from an obscure brand, the risk profile is similar: uncertified AOSP, MQTT-based updates, no AV layer.
Two categories are clearly not at risk. Android Auto — the system most drivers think of when they hear “Android in my car” — runs entirely on your phone and projects to the car screen; the head unit is passive. Certified Android Automotive OS builds (Volvo, GM, Polestar, Renault) require Google Play Protect and enforce firmware signing. QNX-based OEM systems from BMW and Mercedes operate on a different OS entirely. If your head unit has a visible Android app drawer or direct Google Play access on the screen (not through your phone), that’s the category to watch.
To check for infection: apply latest firmware from official DoFun channels, monitor network traffic for connections to the documented C2 domains listed in the Kaspersky Securelist report, and scan with any Android AV tool recognizing the detection signature HEUR:Trojan-Proxy.AndroidOS.Zhima.*. The full IOC list and file hashes are in the Kaspersky disclosure.
Key Takeaways
- Kaspersky disclosed the first malware campaign built specifically for Android automotive head units — attributed to MoYu Group, the BADBOX operators, now expanding from TVs and tablets into connected vehicles.
- The attack requires zero user interaction: it abuses the DoFun TWCore firmware update app via MQTT to silently install a multi-stage dropper that enrolls the car as a proxy botnet node.
- The target is your car’s internet connection, not vehicle controls — the zhima module converts the LTE connection into a residential proxy node resold through commercial proxy services.
- Android Auto users and certified Android Automotive OS owners are not affected. Cheap aftermarket AOSP head units carry the highest risk.
- DoFun has reportedly patched TWCore. Apply firmware updates immediately and check Kaspersky’s IOC list if you run any unbranded Android head unit.
