Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
Summary: Kaspersky discovered in June 2026 a malware family targeting Android-based vehicle head unit firmware from DoFun, spread through the built-in updaters of those units and attributed with high confidence to the MoYu Group, linked to the BADBOX ad fraud and residential proxy scheme. The chain starts with the legitimate system app TWCore, which downloads APKs via an MQTT broker on cardoor[.]cn; attackers weaponized that channel to deliver a dropper called JarService, ending in a background app with no user interface that contacts a C2 endpoint every 90 minutes and supports nine commands for unwanted ads, ad fraud, and downloading further modules.
Why it matters: Kaspersky could not determine how many head units were infected or in which total numbers, even though the malware was activated in multiple countries - so the exposure sits on devices with SIM cards and internet access that most fleets and owners never think to monitor.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026