Cybersecurity researchers have uncovered a concerning supply-chain attack that weaponizes a seemingly legitimate update application to distribute malware to **Android**-based car head units. The primary objective of this malware is to integrate these connected vehicles into a proxy botnet or exploit them for ad fraud. ### MoYu Group Behind the Attack Analysis by **Kaspersky** researchers attributes this operation to the **MoYu group**, a threat actor previously linked to the **BadBox malware botnet**. This incident represents a significant development, as it is the first documented instance of a malware infection chain specifically designed to target automotive head units. ### Targeting DoFun Systems The **MoYu** group's operation specifically targets systems manufactured by **DoFun**, a Chinese automotive software and hardware provider owned by **Shenzhen Driving Control Technology Co., Ltd.** **DoFun** supplies generic **Android**-based head units that serve as the central command hub for a car's infotainment, navigation, and various settings. In June, **Kaspersky** researchers identified a rogue APK file being downloaded from a legitimate **DoFun** system app, **TWCore**. This app receives instructions via an **MQTT** server hosted at `cardoor[.]cn`. ### Malware Functionality: JarService The malicious application, dubbed **JarService**, operates without a visible interface. Upon execution, it decrypts and launches a second-stage loader. This loader then establishes communication with a command-and-control (**C2**) server to download an additional encrypted payload. The final payload is designed to periodically collect and report device information, including the model, display resolution, Wi-Fi SSID, and MAC address. It also retrieves various commands from the attackers. ### Supported Commands and Objectives The malware supports a range of nine commands, enabling diverse malicious activities: 1. **return**: Retrieves a specified value from Android’s SharedPreferences storage. 2. **copy**: Copies stored or downloaded content to the device clipboard. 3. **http**: Sends HTTP GET or POST requests and can save part of the response. 4. **web**: Opens a URL in a WebView and executes supplied JavaScript. 5. **loadlib**: Not fully implemented at the time of Kaspersky's report. 6. **loadlib2**: Downloads and executes arbitrary code or additional modules. 7. **loadlib3**: Not fully implemented at the time of Kaspersky's report. 8. **deeplink**: Opens a specified resource in the browser. 9. **traceroute**: Checks whether specified hosts are reachable using ICMP ping. **Kaspersky** emphasizes that the malware does not interfere with critical driving or vehicle control systems. Its primary purpose appears to be advertising fraud and transforming internet-connected car head units into residential proxy nodes for monetization.  Researchers observed that the attackers predominantly loaded a reverse-proxy module named 'zhima,' effectively turning the compromised head units into proxy botnet nodes. Additionally, the malware was used to initiate web requests for click-fraud activities. **Kaspersky** has informed **DoFun** of their findings, and the Chinese firm has reportedly addressed the issue.