A supply-chain attack against Android-based car head units is abusing a legitimate device-update mechanism to install malware that recruits infected units into a proxy botnet and ad fraud scheme, according to Kaspersky researchers.
The researchers attribute the campaign to MoYu, a threat actor previously linked to the BadBox malware botnet. They describe it as the first documented case of a malware infection chain built specifically for a targeted car head unit product line.
The operation targets head units from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun sells generic Android-based head units that serve as the control center for a vehicle’s infotainment, navigation, and settings systems.
In June, Kaspersky observed a rogue APK being delivered through DoFun’s legitimate TWCore system app, which receives instructions via an MQTT server hosted at cardoor[.]cn. The dropped app, dubbed JarService, has no user interface. On launch, it decrypts and runs a second-stage loader that contacts a command-and-control server and pulls down another encrypted payload.
The final payload beacons device details, including model, display resolution, Wi-Fi SSID, and MAC address, and awaits attacker commands. Kaspersky documented nine supported commands, including reading stored preferences, copying content to the clipboard, sending HTTP requests, executing JavaScript inside a WebView, downloading and running arbitrary code, opening deep links, and running traceroute-style connectivity checks. Two commands were not fully implemented at the time of the report.
Proxy and Ad Fraud Monetization
Kaspersky found the operator primarily deployed a reverse-proxy module named zhima, which converts the head unit into a proxy botnet node, alongside web requests tied to click-fraud activity. The malware does not interfere with driving functions or critical vehicle control systems, and appears purely aimed at monetization through proxy services and ad fraud.
Kaspersky notified DoFun of the findings, and the company said it has resolved the issue. The initial compromise vector, how the rogue APK was first introduced into the TWCore update chain, remains unconfirmed publicly.
The case underscores a growing risk area: connected automotive infotainment systems running generic Android builds with third-party update apps, which can become a supply-chain foothold for botnet operators without ever touching safety-critical vehicle systems.