A supply-chain attack is using a legitimate update application in Android car head units to deploy Android car head unit malware that conscripts vehicles into a proxy botnet or puts them to work committing advertising fraud. Kaspersky researchers attributed the operation to a threat actor called MoYu, previously associated with the BadBox malware botnet, and say this is the first documented infection chain built specifically for this type of automotive hardware.
How the Android car head unit malware infection chain works
MoYu’s operation targets systems from DoFun, a Chinese automotive software, cloud services and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun sells generic Android-based head units, the command centres handling a car’s infotainment, navigation and settings systems. The attack begins with a legitimate DoFun system application called TWCore, which receives instructions through an MQTT server hosted at cardoor[.]cn.
In June, Kaspersky researchers found TWCore downloading a rogue APK file. The unknown application carries no interface and is a piece of malware called JarService. Once launched, JarService decrypts and runs a second-stage loader that connects to a command-and-control (C2) server and pulls down an additional encrypted payload. That final payload periodically reports device information (model, display resolution, Wi-Fi SSID and MAC address) and awaits further instructions from the attackers.
The malware supports nine commands in total: retrieving values from Android’s SharedPreferences storage, copying content to the clipboard, sending HTTP GET or POST requests, opening URLs in a WebView with JavaScript execution, downloading and executing arbitrary code, opening resources in a browser, and checking host reachability via ICMP ping. Two of the nine commands, loadlib and loadlib3, were not fully implemented at the time Kaspersky published its findings.
In practice, Kaspersky found that operators primarily loaded a reverse-proxy module named ‘zhima’, turning infected head units into proxy botnet nodes. As Dark Reading notes, the Android downloader ultimately deploys both that reverse-proxy module and a Trojan clicker (malware designed to covertly click on web adverts) making monetisation the clear end goal. Kaspersky states the malware does not interfere with driving or any critical vehicle control systems.
BadBox lineage and a growing threat to connected devices
MoYu’s connection to BadBox places this campaign in a broader, well-documented pattern. In 2023, cybersecurity company HUMAN Security discovered more than 70,000 Android smartphones, connected TV boxes and tablets from at least one Chinese manufacturer that had shipped with malware linked to the BadBox operation, according to The Record from Recorded Future News. The scale of that discovery underscored how deeply the supply chain had already been compromised before anyone in the security community raised the alarm publicly.
German authorities moved against the original BadBox botnet in December 2024, cutting off communications between infected devices and the hackers’ C2 infrastructure. That disruption was consequential, but clearly not terminal. The FBI subsequently warned that a successor operation, BadBox 2.0, was targeting internet-of-things devices including TV streaming boxes, digital projectors, digital picture frames and aftermarket vehicle infotainment systems, a list that now encompasses exactly the kind of hardware at the centre of Kaspersky’s latest findings.
The automotive dimension is what makes this particular campaign worth paying attention to. Car head units sit in an unusual position: they are persistent, always-on, internet-connected devices with a stable residential IP address, which makes them attractive as proxy nodes. Unlike a compromised phone that gets wiped or replaced within a year or two, a head unit can sit in the same vehicle for a decade.
Kaspersky says it notified DoFun of its findings. DoFun replied that it has resolved the problem. BleepingComputer has separately contacted both companies seeking detail on the initial compromise vector; no response had been received at the time of publication. The precise point at which MoYu first introduced the rogue APK into DoFun’s update infrastructure remains publicly unknown.
