**Kaspersky** researchers have identified a novel malware family targeting Android-based vehicle head units, marking the first documented instance of malware with an infection chain tailored for this specific device type. The primary objective of this sophisticated threat is to facilitate ad fraud and build a proxy botnet through a multi-stage downloader. ### The MoYu Group Connection This malicious activity has been confidently linked to the **MoYu Group**, previously exposed by the **HUMAN Satori Threat Intelligence and Research** team for their involvement in the **BADBOX** ad fraud and residential proxy scheme. In July 2025, **Google** initiated a lawsuit against 25 entities in China, alleging their operation of the **BADBOX** botnet. ### Vulnerability in Automotive Systems Android-powered car head units, which serve as central multimedia and control hubs, have gained significant popularity in both aftermarket installations and factory-built vehicles. Their ability to run standard Android applications, coupled with SIM card slots for internet access, makes them an increasingly attractive target for threat actors. According to security researcher **Dmitry Kalinin**, the malware's delivery method is particularly concerning. "In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app," Kalinin stated. ### Exploiting Software Updates The attack leverages the update mechanisms built into the firmware of multiple **DoFun**-powered Android head units. The initial point of compromise is a legitimate system application named **TWCore** ("com.tw.core"), which is designed for analytics collection and software updates via APK files, utilizing an **MQTT** message broker on the "cardoor[.]cn" subdomain. Threat actors weaponized this legitimate update channel to distribute a previously unknown malware directly to head units. This dropper, dubbed **JarService**, employs evasion techniques and launches a loader that communicates with attacker servers. It sends implant information and receives a link to download the next-stage payload, with **Kaspersky** identifying multiple variants dating back to "3.57".  ### Covert Operations and Extensive Capabilities The final malware payload operates as a covert background application without a user interface. It periodically sends **POST** requests to its command-and-control (**C2**) endpoint, providing device information and checking for configuration updates. If the configuration is outdated, the **C2** server supplies new **C2** addresses and **HTTP** request paths. Otherwise, it returns integer command identifiers, referred to as `productId`. These commands, stored as serialized **JSON** objects, empower the malware to perform various malicious actions, including displaying unwanted advertisements, executing ad fraud, and downloading additional modules. It can also exfiltrate extensive device information, such as display resolution, device model, **Wi-Fi** network identifier, and **MAC** address. Supported commands include: * `return`: Returns a value from **SharedPreferences**. * `copy`: Sets clipboard contents. * `http`: Makes **POST/GET HTTP** requests to specified resources. * `web`: Opens a link in **WebView** and executes arbitrary **JavaScript** code. * `loadlib` (not fully implemented) * `loadlib2`: Downloads and executes arbitrary code from a URL. * `loadlib3` (not fully implemented) * `deeplink`: Opens a URL in the browser. * `traceroute`: Checks resource availability via an **ICMP** ping. Notably, the threat actors have utilized the `loadlib2` and `http` commands to deploy **zhima**, a reverse proxy module previously documented by the **Nokia Deepfield Emergency Response Team**. This module has been observed in conjunction with **IPTV** applications installed on low-cost Android TV boxes. "Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the **BADBOX** botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide," Kalinin noted. "This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This serves as a warning that modern automotive platforms urgently require robust protection against malware."