Listen to this Post
A New Cybersecurity Frontier Inside the Car
The modern car is no longer just a machine with an engine, wheels, and a dashboard. It is increasingly a connected computer on four wheels, equipped with cellular connectivity, Wi-Fi, Bluetooth, navigation, cloud services, downloadable applications, and sophisticated infotainment systems. That transformation has created enormous opportunities for drivers—and an entirely new attack surface for cybercriminals.
Now, security researchers have uncovered what appears to be the first documented malware campaign specifically targeting Android-based automotive head units at scale.
The discovery is particularly concerning because the attackers did not simply trick drivers into downloading a malicious application. Instead, they abused legitimate software already present inside the vehicle’s infotainment environment. According to Kaspersky’s research, malware associated with the BADBOX ecosystem was delivered through the legitimate TWCore system component used by DoFun head units.
The campaign turns an overlooked component of the connected-car ecosystem into something much more sinister: a remotely controlled node inside a proxy botnet.
And that changes the conversation around automotive cybersecurity.
From Smartphones to Cars
BADBOX has already demonstrated how valuable poorly secured Android-based hardware can become to cybercriminals. Android televisions, TV boxes, and other connected devices can be silently converted into infrastructure for advertising fraud, proxy services, credential abuse, and other criminal operations.
The latest campaign suggests that criminals are beginning to view automotive infotainment hardware through exactly the same lens.
Instead of asking whether a compromised head unit can steal someone’s banking password, attackers can ask a different question: Can this device quietly become another server in our criminal infrastructure?
That distinction is important.
The malware described by Kaspersky appears focused heavily on proxy monetization and click fraud rather than directly controlling vehicle safety systems. Nevertheless, the compromise demonstrates that an internet-connected Android head unit can be remotely manipulated without the driver’s knowledge.
The Attack Begins With Legitimate Software
One of the most disturbing elements of the campaign is the delivery mechanism.
Researchers investigating Android threats in June 2026 encountered a suspicious application that behaved unlike a normal Android application. It installed without presenting a conventional user interface, making it effectively invisible to the person sitting in the driver’s seat.
Further investigation traced the infection to DoFun head-unit firmware.
Inside that firmware was a legitimate system application called TWCore, which was designed to perform functions associated with analytics and software updates.
That sounds harmless.
But legitimate update mechanisms are extremely powerful. They already possess the permissions and trusted position necessary to modify software on the device.
The attackers exploited that trust.
The MQTT Update Pipeline Became the Door
According to the research, TWCore communicates with an MQTT broker associated with cardoor[.]cn.
MQTT is widely used in connected-device environments because it provides lightweight messaging between devices and servers. In the right architecture, it is perfectly legitimate.
The problem appears to have been how TWCore interpreted certain update instructions.
A Boolean parameter called installNotExists could instruct the component to install an APK even when that application had not previously existed on the device.
In other words, the update mechanism could be transformed from:
Update software that belongs on this device.
into:
Install this previously unknown application.
That is an enormous difference from a security perspective.
Kaspersky reported the issue to the vendor, which subsequently said the problem had been fixed.
Why Silent Installation Is So Dangerous
A normal Android application typically leaves evidence that a user can recognize: an icon, a package name, a visible interface, or a notification.
This campaign attempted to avoid those signals.
The initial malware component was effectively headless, meaning it had no conventional user interface. A driver could therefore continue using navigation, music, Bluetooth, or other infotainment functions without realizing that additional malicious software was operating underneath.
This is a classic example of why endpoint visibility matters.
A device can appear completely normal from the user’s perspective while simultaneously performing unauthorized network communications in the background.
Stage One: JarService Opens the Chain
The malware uses a multi-stage architecture designed to separate delivery, loading, command-and-control communication, and monetization.
The first component, identified as JarService, functions as a dropper.
Rather than immediately exposing its complete functionality, it decrypts encrypted blocks and uses reflection to load the next stage.
This architecture makes static analysis more difficult because the malicious functionality is not necessarily presented in an obvious form when the initial component is inspected.
The use of XOR-encrypted payload blocks is not particularly sophisticated by itself. The real advantage comes from combining encryption, reflection, staged loading, and a lack of visible user interaction.
Stage Two: The Loader Starts Calling Home
The second stage is responsible for establishing communication with the attackers’ infrastructure.
It collects information that can be used to fingerprint the infected device and then retrieves a URL pointing toward the next malicious component.
Researchers identified a particularly interesting thread or component name in this stage:
mosdk-host-loader
That seemingly ordinary technical identifier became one of the clues connecting the automotive campaign to the wider MoYu ecosystem.
Stage Three: BillingMain Becomes the Controller
The third stage, tracked as BillingMain, provides the campaign with a more operational layer.
It periodically communicates with command-and-control infrastructure, reportedly checking in approximately every 90 minutes.
The communication includes device fingerprint information and can receive configuration updates or commands.
Among the commands identified by researchers are:
http
web
loadlib2
deeplink
The presence of these commands reveals that the malware was not designed merely to sit passively inside the vehicle.
It was built as a remotely managed platform.
The Most Important Payload: Zhima
The most consequential component is zhima, a reverse-proxy module.
This changes the economic purpose of the attack.
Instead of merely infecting a device, the criminals can potentially turn the compromised head unit into an intermediary through which other internet traffic is routed.
That creates a proxy resource that can potentially be monetized.
The concept is similar to what has already been observed with compromised Android TV boxes and other consumer devices. Nokia Deepfield researchers independently identified the zhima proxy component in Android-based set-top-box environments, providing an important link between the automotive campaign and the broader infrastructure.
Why Criminals Want Your
A connected car may possess something cybercriminals value enormously: a persistent internet connection.
Depending on the hardware configuration, the infotainment system may have cellular connectivity, Wi-Fi access, cloud connectivity, and enough processing power to perform network operations continuously.
From a criminal perspective, that can make an infected head unit resemble a small server.
The owner pays for the connectivity.
The vehicle provides the hardware.
The malware provides the software.
And the criminal operator potentially collects the revenue.
That is a powerful business model for cybercrime.
The Click-Fraud Connection
The campaign is not limited to proxy activity.
BillingMain also contains clicker functionality associated with advertising fraud.
This creates a dual monetization strategy.
One component can potentially generate fraudulent advertising activity, while another can turn infected devices into nodes in a proxy network.
That diversification is significant because cybercriminals increasingly treat malware infrastructure as a business platform rather than a single-purpose tool.
If one revenue stream becomes less profitable, another can be activated remotely.
Why Researchers Linked the Operation to MoYu Group
Attribution in cybercrime investigations is rarely based on one piece of evidence.
In this case, researchers found multiple technical clues connecting the campaign to MoYu Group, an actor associated with the BADBOX ecosystem.
The mosdk-host-loader component was particularly revealing because it appeared alongside references connected to a malicious set-top-box application containing a service named AdmoyuService.
Infrastructure similarities added another layer.
Researchers identified a zhima administration panel associated with admin.uipoxy[.]com, while authentication and API patterns overlapped with infrastructure connected to residential proxy services such as PXYEDGE and ProxyForU.
Taken together, those clues provide a much stronger attribution picture than any single domain or filename could provide.
The BADBOX Connection Matters
The larger BADBOX story is what makes this development especially important.
BADBOX demonstrated that Android-based consumer electronics can become valuable components of criminal infrastructure.
Removing individual command-and-control servers or disrupting individual malware samples does not necessarily eliminate the business model.
Criminal groups can simply search for another class of vulnerable devices.
Smart TVs became attractive.
TV boxes became attractive.
IoT hardware became attractive.
Now automotive infotainment systems are entering the picture.
That is the evolution security teams should be watching.
The Automotive Head Unit Is an Overlooked Computer
Many people still mentally separate a
Technically, that distinction can be misleading.
Modern head units can contain processors, operating systems, storage, networking stacks, application frameworks, wireless interfaces, microphones, cameras, and access to various vehicle services.
Kaspersky’s earlier automotive research has also demonstrated that head units can contain complex internal networks and substantial attack surfaces.
The important point is not that every compromised infotainment system can control the brakes or steering.
It is that the infotainment system itself is now a serious computing platform that must be defended accordingly.
This Does Not Automatically Mean Your Car Can Be Remotely Hijacked
There is an important distinction that should not be lost in the excitement surrounding this discovery.
The reported campaign demonstrates malware targeting Android automotive head units.
It does not, by itself, prove that attackers can remotely steer every affected vehicle, disable brakes, unlock doors, or take control of critical driving systems.
Modern vehicles can employ segmentation and security gateways between infotainment systems and safety-critical electronic control units.
Kaspersky’s automotive-security research specifically describes modern vehicle architectures as increasingly divided into security domains, often using firewalls and central gateways.
That separation is extremely important.
However, segmentation should not become an excuse for ignoring an infected head unit.
A compromised infotainment system can still create privacy, networking, fraud, surveillance, and supply-chain risks—and potentially provide a foothold for additional attacks if other defenses are weak.
Deep Analysis: How Defenders Can Investigate Android Head Units
Identify Unexpected Packages
For authorized forensic or laboratory analysis, defenders can use Android Debug Bridge to inventory installed packages:
adb shell pm list packages -f
Suspicious system-level packages should be compared against the vendor’s official firmware image and software bill of materials where available.
Inspect Running Services
Security teams can inspect active Android services:
adb shell dumpsys activity services
Unexpected services with no documented business purpose deserve additional investigation.
Review Installed Applications
A useful first-pass investigation is to enumerate packages and installation paths:
adb shell pm list packages -3
adb shell pm list packages -s
The first command focuses on third-party packages, while the second lists system packages.
Examine Network Configuration
Defenders can inspect network interfaces and routing information:
adb shell ip addr
adb shell ip route
Unexpected interfaces or routing behavior can help identify abnormal networking activity.
Review Recent System Logs
For authorized diagnostic environments, Android logs can provide additional evidence:
adb logcat -d | grep -iE install|package|mqtt|proxy|download
Investigators should avoid assuming that a matching string proves compromise. Logs must be correlated with package metadata, timestamps, firmware versions, and network telemetry.
Monitor Suspicious Connections
Where supported by the test environment, defenders can inspect active connections:
adb shell dumpsys connectivity
Network-level monitoring can also be performed externally using appropriate enterprise sensors or packet-capture infrastructure.
Search Firmware for Suspicious Indicators
When analyzing an extracted firmware image, defenders can search for relevant identifiers:
grep -RniE "mosdk-host-loader|AdmoyuService|BillingMain|zhima|installNotExists" firmware/
This should be performed against a forensic copy rather than a production vehicle.
Build a Baseline
The most effective detection strategy is often simple: know what belongs there.
Create a trusted baseline for:
System packages
Package hashes
Update servers
MQTT brokers
Certificate chains
DNS destinations
Scheduled services
Network connections
Firmware versions
Privilege levels
Anything outside that baseline becomes easier to investigate.
What Undercode Say:
1. Cars Are Becoming Endpoint Devices
The biggest lesson from this campaign is not merely that Android malware reached a car.
It is that automotive head units have become endpoints in the same sense as phones, laptops, routers, and smart TVs.
They need endpoint-security thinking.
2. Trust Can Become an Attack Vector
TWCore was legitimate software.
That is precisely why abusing it was valuable.
Security teams cannot protect systems by looking only for obviously malicious applications.
Trusted applications with excessive privileges can become the most dangerous components in an attack chain.
3. Software Updates Need Strong Authentication
A software update mechanism should never become an unrestricted application installer.
Update systems need cryptographic signing, strict package validation, authorization controls, rollback protection, and careful server-side access management.
4. MQTT Deserves Security Attention
MQTT is not inherently insecure.
The danger comes from how it is implemented.
Authentication, authorization, TLS, topic permissions, certificate validation, and strict message validation all matter.
A compromised broker or weak update command can turn a legitimate messaging protocol into a malware delivery channel.
5. The User May Never Notice
This campaign is particularly dangerous because there may be no obvious symptom.
The screen can work.
Navigation can work.
Music can work.
Bluetooth can work.
The vehicle can behave normally.
Meanwhile, a background process could be communicating with remote infrastructure.
6. Proxy Botnets Need New Victim Classes
Cybercriminals have already discovered that residential IP addresses can be monetized.
The more devices they compromise, the larger their proxy pools become.
Automotive connectivity potentially adds another category of internet-connected hardware to that economy.
- The Business Model Is More Important Than the Malware Name
Names such as BADBOX, MoYu, BillingMain, and zhima are useful for tracking campaigns.
But defenders should focus on the underlying economics.
Attackers want computing resources.
They want bandwidth.
They want persistent connectivity.
They want automation.
And they want devices that are difficult for victims to monitor.
- Automotive Suppliers Need a Different Security Mindset
Traditional automotive security programs often focus heavily on vehicle control systems.
That remains essential.
But infotainment systems need their own threat model.
They are effectively embedded computers connected to increasingly sophisticated networks.
9. Third-Party Hardware Creates Additional Risk
Not every head unit is developed directly by the vehicle manufacturer.
Aftermarket hardware, regional variants, white-label Android systems, and third-party software components can create additional supply-chain exposure.
A vehicle may therefore inherit vulnerabilities from a component supplier that the driver has never heard of.
- Firmware Is Part of the Software Supply Chain
Security cannot stop at mobile applications.
Firmware images, update servers, cloud APIs, brokers, certificates, build pipelines, and signing infrastructure all belong in the security model.
The weakest component can become the
- Silent Installation Is a Major Warning Sign
Any legitimate component capable of remotely installing arbitrary software deserves particularly strong controls.
The ability to install an application that was never previously present should be tightly restricted.
It should not be treated like an ordinary configuration option.
12. Proxy Malware Changes the Risk Calculation
A proxy infection does not necessarily need access to sensitive personal files to make money.
The
That makes these campaigns attractive even when traditional data theft is not the primary objective.
13. Click Fraud Adds Another Revenue Stream
The clicker component makes the campaign even more interesting.
Attackers can monetize infected hardware without necessarily interacting with the driver.
That creates an incentive to keep infections quiet and persistent.
14. Persistence Is the Real Prize
A temporary infection has limited economic value.
A device that remains online for weeks or months can continuously generate revenue.
Connected vehicles are potentially attractive precisely because they may spend long periods online without human supervision.
15. Fleet Operators Should Pay Attention
Commercial fleets could be particularly interesting targets.
A large fleet may contain hundreds or thousands of vehicles using identical or similar head-unit firmware.
One vulnerable software supply chain could therefore produce a large number of compromised endpoints.
16. Vendor Remediation Is Encouraging
The vendor reportedly addressed the TWCore issue after disclosure.
That is the correct response.
Responsible disclosure can prevent a vulnerability from becoming a long-term systemic weakness.
- But Patching One Vendor Is Not Enough
The broader problem is architectural.
If one Android head-unit ecosystem contains an insecure update mechanism, others may contain similar weaknesses.
The industry should treat this incident as a warning rather than an isolated anomaly.
18. Security Testing Must Include Update Mechanisms
Penetration testing should not focus exclusively on exposed ports and application vulnerabilities.
Researchers should test how firmware updates are authenticated.
They should test whether arbitrary APKs can be installed.
They should examine update commands and backend authorization.
19. Security Gateways Remain Critical
Even if the infotainment system becomes compromised, a properly segmented vehicle architecture can limit what the attacker can reach.
This is one of the strongest arguments for defense in depth.
20. Segmentation Is Not a Cure-All
A segmented head unit can still become a criminal proxy node.
It can still consume bandwidth.
It can still expose personal data.
It can still damage the
Segmentation reduces impact, but it does not eliminate compromise.
21. Detection Must Move Beyond the Dashboard
Drivers cannot realistically inspect background processes inside an infotainment system.
Security therefore needs to exist at the firmware, gateway, cloud, and fleet-management levels.
22. Automotive SOCs Will Become More Important
Security operations centers increasingly need visibility into connected vehicles.
Telemetry from vehicle gateways, cloud services, update infrastructure, and endpoint software can provide the evidence needed to identify abnormal behavior.
23. Indicators of Compromise Still Matter
Kaspersky’s publication provides defenders with indicators associated with the campaign, including malware detections, infrastructure, and hashes.
These indicators can help organizations investigate potentially affected systems.
- But IOCs Have a Short Shelf Life
Domains can disappear.
Hashes can change.
Malware can be rebuilt.
Infrastructure can move.
Behavioral detection is therefore more durable than relying solely on static indicators.
25. The Next Campaign May Look Different
Attackers do not need to reuse JarService forever.
They can replace the dropper, change the broker, modify the proxy module, or adopt another monetization platform.
The defensive architecture must therefore focus on behaviors.
26. Connected Cars Are Attractive IoT Targets
The broader IoT lesson is returning with a vengeance.
Any device that is connected, powerful, remotely managed, and difficult for its owner to inspect can become an attractive target.
Cars increasingly satisfy all four conditions.
27. The Economics Will Drive Expansion
Cybercriminals follow money.
If compromised head units prove profitable as proxy nodes or advertising platforms, attackers will have an incentive to expand the operation.
- Automotive Cybersecurity Is Now Also About Bandwidth
Security teams have traditionally focused on confidentiality, integrity, and availability.
Connected-car malware adds another concern: unauthorized monetization of the vehicle’s connectivity.
29. Privacy Risks Should Not Be Ignored
Even when the primary objective is proxy monetization, compromised infotainment systems may have access to sensitive contextual information.
Depending on the platform, this could include device identifiers, location-related data, network information, Bluetooth metadata, or other telemetry.
- The Update Server Is as Important as the Device
A perfectly secured head unit can still be endangered if the infrastructure responsible for updating it is compromised.
The software supply chain therefore extends far beyond the vehicle.
31. Vendors Need Reproducible Firmware Builds
Reproducible builds and strong software provenance can help manufacturers determine exactly what software belongs inside a legitimate firmware release.
32. Cryptographic Signing Should Be Mandatory
Every executable component delivered through an update mechanism should be authenticated cryptographically.
A remote server should never be trusted merely because it belongs to the same network ecosystem.
33. Security Researchers Will Follow the Money
Once proxy monetization becomes associated with automotive hardware, researchers are likely to examine additional Android head-unit families.
That could reveal whether this is an isolated campaign or the beginning of a broader trend.
- Fleet Security Could Become a Major Industry
Vehicle cybersecurity is already becoming a major discipline.
The emergence of malware monetizing infotainment connectivity adds another reason for fleet operators to invest in centralized monitoring and response.
- The Driver Is Not the Only Victim
The driver may never intentionally download anything.
The vehicle owner may not even know the infection exists.
The compromised device is being exploited as infrastructure, making the owner an unwitting participant in someone else’s criminal operation.
36. This Is a Supply-Chain Story
At its core, the incident is about trust relationships.
A vendor trusts an update component.
The update component trusts a message broker.
The device trusts the software package.
The driver trusts the dashboard.
The attackers attempt to exploit the chain between those assumptions.
- Security Needs to Follow Those Trust Relationships
Every automated trust decision should be questioned.
Who can send the update?
Who authenticates the sender?
Who signs the package?
Who validates the package?
Can the package install new applications?
Can the device reject unexpected commands?
Those questions should be answered before deployment.
- The Head Unit May Be the Beginning, Not the End
Today’s attack may be focused on proxy monetization.
Tomorrow’s attacker could attempt credential theft, surveillance, ransomware, lateral movement, or attacks against connected services.
That does not mean those scenarios are happening here.
It means the underlying access deserves serious attention.
- Automotive Security Must Think Like Enterprise Security
The car is becoming an enterprise-like computing environment.
It needs asset inventories, vulnerability management, identity controls, monitoring, incident response, secure updates, and supply-chain governance.
- The Invisible Passenger Is the Real Warning
The most important lesson is simple.
The biggest danger may not be a dramatic cyberattack that suddenly disables a vehicle.
It may be something much quieter.
A malicious process running silently in the background.
A compromised update mechanism.
A vehicle contributing bandwidth to a criminal proxy network.
A driver who never realizes anything happened.
That is why this campaign deserves attention.
✅ The Campaign Is Real
Kaspersky’s own research archive confirms a campaign involving Android malware delivered through legitimate software associated with DoFun head units, with the malware described as capable of building a proxy botnet and serving ads.
✅ The Automotive Attack Surface Is Genuine
Kaspersky has separately documented extensive attack surfaces in automotive head units, including networking, firmware, USB interfaces, diagnostics, and internal services. This supports the broader claim that infotainment systems are meaningful cybersecurity targets.
✅ Modern Vehicle Segmentation Can Limit Impact
Kaspersky’s automotive research explains that modern vehicles increasingly separate electronic systems into security domains using mechanisms such as central gateways and firewalls. Therefore, compromising an infotainment system should not automatically be interpreted as gaining direct control over safety-critical driving functions.
⚠️ Attribution Should Be Treated as High-Confidence, Not Absolute
The available reporting describes multiple technical and infrastructure overlaps connecting the operation to MoYu Group and the BADBOX ecosystem. However, cyber attribution is inherently probabilistic, so infrastructure reuse and code similarities should be understood as strong evidence rather than mathematical proof of operator identity.
Prediction
(+1) Automotive Android Malware Will Become a Larger Security Category
The most likely direction is continued growth in attacks against connected infotainment systems, especially inexpensive Android-based platforms that rely on third-party firmware and remotely managed update mechanisms.
As connected vehicles become more common, attackers will have more reasons to search for vulnerable head units that can provide persistent connectivity, computing resources, advertising-fraud capacity, or proxy bandwidth.
The next major campaigns may not necessarily target the vehicle’s safety functions at all.
Instead, criminals may continue treating cars as another category of connected infrastructure.
That could make automotive malware detection an increasingly important part of both fleet security and consumer cybersecurity.
The Most Important Defensive Prediction
The industry will increasingly move toward signed firmware, hardware-backed trust, stricter application allowlists, secure update architectures, network segmentation, and centralized telemetry.
Manufacturers that treat infotainment systems as ordinary consumer Android devices may discover that criminals have already recognized what the industry overlooked:
A connected car is also a computer—and computers attract attackers.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
