Listen to this Post
Introduction: When the Car Becomes Another Computer
Modern cars are no longer simply machines with engines, brakes, steering systems, and dashboards. Increasingly, they are connected computing platforms with operating systems, application frameworks, wireless connectivity, cloud services, update mechanisms, and powerful infotainment systems.
A New Security Boundary Has Been Crossed
That transformation brings convenience, but it also creates an uncomfortable reality: every connected computer inside a vehicle can become another potential target.
The Discovery That Changed the Conversation
In June 2026, Kaspersky researchers uncovered an Android malware campaign that pushed this concern into unfamiliar territory. The researchers identified what they described as the first documented malware infection targeting an Android-based automotive head unit through a vehicle’s built-in firmware update mechanism.
Why This Discovery Matters
The malware was not primarily designed to steal banking credentials or remotely drive a vehicle. Its purpose was more industrial and quietly profitable. The infected head units were turned into components of an advertising-fraud and proxy botnet operation.
The Real Danger Was Hidden in the Update System
The most disturbing part of the campaign was not simply that malware could run on a car’s Android system. It was that a legitimate system application responsible for analytics and firmware updates became part of the infection chain.
Android Inside the Dashboard
Many modern automotive head units use Android because it provides manufacturers with a flexible software foundation. Developers can build custom interfaces, integrate navigation, connect media services, communicate with smartphones, and add manufacturer-specific applications.
Flexibility Comes With a Cost
But
A Smartphone Without the Smartphone
From an
But Connectivity Is Valuable
What the attackers discovered is that the device does not need valuable personal files to be useful. It needs something else: an internet connection, computing resources, and a position inside a large population of connected devices.
The Infection Begins With TWCore
According to
The Update Mechanism Becomes the Attack Path
TWCore communicates with an MQTT message broker that can provide instructions regarding APK files that should be downloaded and installed.
The Dangerous Configuration Flag
One configuration option, called installNotExists, controls whether TWCore checks whether an application is already installed before attempting to install it.
A Small Setting With a Big Consequence
When configured in the wrong way, the mechanism can effectively become a silent application installation pipeline.
From Update to Malware Delivery
Instead of the update channel being restricted to trusted firmware components, the same mechanism can potentially be abused to deliver additional APK packages.
The First Stage: JarService
The malware initially installs a small component researchers identified as JarService.
No Interface. No Suspicious Icon. No Warning
JarService contains no visible user interface. Its job is deliberately simple: decrypt and load the next stage.
The Second Stage Takes Over
Once activated, the next-stage loader communicates with command-and-control infrastructure, reports information about the infected device, and receives instructions about where to obtain the next payload.
Multiple Versions Were Available
Kaspersky researchers found that the third-stage component could be downloaded in at least seven different versions by manipulating version numbers within the download URL.
A Modular Malware Architecture
That detail reveals something important about the operation. The attackers were not relying on one fixed malware package.
The Malware Could Evolve
A modular architecture allows criminals to replace components, change configurations, deploy updated infrastructure, and potentially introduce new functionality without completely rebuilding the initial infection mechanism.
The Third Stage Becomes a Clicker and Proxy Tool
The next component communicates with the
What the Malware Reports
The communication can include information such as the device model, display resolution, connected Wi-Fi network SSID, MAC address, and configuration version.
The Configuration Can Be Updated Remotely
If the malware determines that its configuration is outdated, the command server can provide new command-and-control addresses and new HTTP request paths.
Nine Commands Reveal the
Researchers discovered nine commands supported by the command system.
More Than a Simple Downloader
Those commands can perform actions including modifying clipboard contents, making HTTP requests, loading web pages, executing JavaScript, downloading additional software, and running new code.
Two Commands Appeared Especially Important
In observed activity, attackers primarily relied on functionality that allowed them to download and execute additional code and send web requests.
The Car Was Not the Final Target
This distinction is crucial.
The Attackers Wanted the Connection, Not the Steering Wheel
The malware did not appear to be primarily designed to take control of the vehicle’s steering, brakes, accelerator, or other driving functions.
The Internet Connection Was the Prize
The compromised head unit could instead become a network endpoint inside a larger proxy infrastructure.
Meet zhima
One additional module identified by researchers was called zhima.
A Reverse Proxy Inside a Vehicle
The component effectively transformed the infected head unit into a reverse proxy, allowing external traffic to be routed through the compromised device.
Why Criminals Want Residential-Like Connections
Internet traffic coming from ordinary consumer networks can be valuable to cybercriminals because it may appear more legitimate than traffic originating from known hosting providers or data centers.
Thousands of Cars Could Become a Distributed Network
If enough head units are compromised, attackers can potentially build a geographically distributed proxy infrastructure using devices that their owners may never realize have been infected.
The Business Model Is the Darker Story
The campaign appears connected to a larger ecosystem rather than being an isolated experiment.
Infrastructure Points Toward MoYu Group
Kaspersky attributed the activity with high confidence to MoYu Group, an actor associated with the BADBOX botnet ecosystem.
A Familiar Name in a New Device Category
BADBOX-related activity has previously involved smart TVs and Android-based set-top boxes.
Cars Now Enter the Picture
The significance is not simply that criminals discovered another Android device.
It Shows How Botnet Operators Adapt
When one class of device becomes harder to compromise, attackers search for another class with similar characteristics: always connected, widely deployed, relatively poorly monitored, and capable of running software.
The mosdk-host-loader Clue
Researchers found an internal thread name, mosdk-host-loader, inside the second-stage loader.
Connecting the Dots
That naming convention reportedly matched malware previously discovered on television set-top boxes associated with the same broader ecosystem.
Infrastructure Overlap Strengthened the Attribution
Researchers also identified overlapping network infrastructure that independently connected the activity to the same group.
A Proxy Service With a Commercial Appearance
Another unusual discovery involved the administration panel used by the proxy infrastructure.
Invite Codes Instead of Open Registration
The panel apparently allowed accounts to be created when users possessed a valid invitation code.
Commercial Proxy Services Enter the Picture
The copyright information and login-page design showed similarities to at least two commercial residential-proxy services.
A Criminal Marketplace May Be Behind the Infrastructure
This raises the possibility that infected vehicles were not merely being used for a temporary botnet experiment.
Compromised Cars Could Become a Revenue Source
If infected devices are integrated into a proxy marketplace, criminals could potentially monetize the bandwidth and connectivity of victims without the victims knowing their vehicles are participating.
Why the Attack Is More Serious Than It Looks
At first glance, advertising fraud and proxy traffic may seem less dangerous than ransomware or remote vehicle control.
But the Strategic Implication Is Much Larger
The campaign demonstrates that vehicle infotainment systems can become part of the same cybercrime economy that already targets phones, smart televisions, routers, cameras, and set-top boxes.
The Attack Surface Is Expanding
Every connected device adds another potential entry point into the digital ecosystem surrounding consumers.
The Update Mechanism Is Especially Sensitive
Software updates are normally considered one of the strongest security controls available to manufacturers.
Trust Can Become a Weapon
When an update system has excessive installation privileges, attackers who compromise or abuse that mechanism can potentially bypass many conventional defenses.
The User May Never See Anything
Because the malware had no visible interface, the vehicle owner could have little reason to suspect anything unusual.
No Pop-Up Is Required
The head unit does not need to display a warning.
No Suspicious App Icon Is Necessary
The malware can operate in the background.
No Obvious Performance Problem May Appear
A proxy operation can potentially consume resources gradually enough to avoid immediately attracting attention.
This Is the Perfect Environment for Persistent Malware
Vehicles are often treated as appliances rather than computers.
That Mental Model Is Becoming Dangerous
Owners expect their phones and laptops to require security updates and malware protection.
They Rarely Think About the Dashboard the Same Way
Yet modern head units can contain processors, storage, operating systems, wireless interfaces, application frameworks, and persistent internet connectivity.
The Security Model Must Catch Up
Manufacturers can no longer treat infotainment software as an isolated entertainment component.
Update Channels Need Stronger Controls
A secure automotive update mechanism should enforce strict cryptographic verification, trusted package sources, authorization boundaries, installation policies, and detailed audit logging.
MQTT Deserves Particular Attention
Messaging protocols such as MQTT are useful for connected devices because they provide lightweight communication.
But Lightweight Communication Still Needs Strong Authentication
A message broker should never become a shortcut around application-level trust controls.
Installation Privileges Should Be Minimized
A component responsible for analytics should not automatically possess unrestricted authority to install arbitrary applications.
This Is a Classic Privilege Problem
The more powerful a system component becomes, the more damaging its compromise can be.
Deep Analysis
The First Question: What Exactly Was Compromised?
The campaign appears to have targeted the software ecosystem surrounding Android-based automotive head units rather than directly compromising a vehicle’s mechanical driving controls.
The Critical Asset Was the Head Unit
The head unit became the execution environment for the malware.
The Second Critical Asset Was Connectivity
The attackers gained access to a device capable of communicating with the internet from inside the vehicle.
The Third Asset Was Trust
The most important element may have been the trusted update pathway.
A Security Boundary Was Crossed
Normally, the operating system should distinguish between legitimate manufacturer software and unauthorized applications.
The Update Mechanism Complicated That Boundary
If an update component can download and install APK files based on remote instructions, its security becomes fundamental to the entire platform.
What Defenders Should Look For
Security teams analyzing Android automotive platforms should monitor unexpected APK installation events.
Example: List Installed Packages
adb shell pm list packages -3 Example: Inspect Installed Applications
adb shell pm list packages -f Example: Examine Running Processes
adb shell ps -A Example: Search Android Logs
adb logcat | grep -iE "install|apk|package|mqtt|http" Example: Monitor Package Installation Events
adb logcat | grep -i "PackageManager" Example: Inspect Network Connections
adb shell dumpsys connectivity Example: Review Application Information
adb shell dumpsys package <package.name> Example: Identify Suspicious APK Files
find /data /sdcard -type f -name ".apk" 2>/dev/null Example: Search for Suspicious Network Indicators
grep -RniE "c2|/api/|mqtt|proxy|download|task" /path/to/extracted/files/
Important Operational Warning
These commands are intended for authorized security testing, incident response, laboratory analysis, or forensic investigation.
The Bigger Defensive Lesson
The goal should not be to hunt for one specific malware name.
Defenders Should Hunt for Behavior
Unexpected APK downloads, unexplained package installations, persistent background services, unusual outbound HTTP traffic, repeated periodic connections, and unexplained proxy behavior are more durable indicators than a single filename.
Network Monitoring Can Help
A vehicle gateway or associated security infrastructure should identify unusual outbound traffic patterns.
Periodic Beaconing Is Especially Interesting
A process that communicates with the same remote infrastructure at predictable intervals can provide a valuable detection signal.
Configuration Changes Matter Too
Security monitoring should pay attention to unexpected changes involving update servers, package repositories, installation policies, or remote configuration.
Firmware Integrity Must Be Verifiable
Manufacturers should ensure that every legitimate firmware and software component can be cryptographically authenticated.
Application Installation Should Be Restricted
If a head unit does not need third-party applications, arbitrary APK installation should be disabled or tightly controlled.
Update Infrastructure Needs Segmentation
The component responsible for downloading updates should not automatically have unrestricted access to unrelated system functionality.
Incident Response Needs Automotive Visibility
Traditional enterprise security tools cannot assume that the dashboard is irrelevant.
Vehicles Are Becoming Endpoints
The modern security team may eventually need to treat connected vehicles in much the same way it treats laptops, phones, routers, and IoT devices.
What Undercode Say:
Cars Have Quietly Become IoT Devices
The most important lesson from this campaign is that connected cars increasingly belong to the same security category as other internet-connected devices.
The Dashboard Is No Longer Just a Display
An Android head unit can be a fully capable computing platform with applications, storage, networking, and background services.
Criminals Follow Economics
Attackers do not necessarily care about controlling the vehicle itself.
Bandwidth Can Be Monetized
If compromised cars can provide useful network connectivity, that connectivity becomes a commodity.
Botnets Are Becoming More Diverse
The traditional image of a botnet made from infected computers is outdated.
Smart TVs Were Once Considered Harmless
Then set-top boxes became targets.
Routers Became Botnet Infrastructure
Now automotive systems are entering the same conversation.
The Common Denominator Is Connectivity
The device does not have to contain sensitive files.
It Only Needs to Be Useful
That is what makes this campaign particularly interesting.
The Attackers Found Value in the Network
The vehicle provided a persistent connection that could potentially be monetized.
Official Software Can Become the Weakest Link
The presence of a legitimate updater does not automatically make an installation secure.
Trust Must Be Verified Continuously
A system should not assume that every remote instruction is legitimate simply because it arrived through an official communication channel.
Update Systems Need Defense in Depth
Cryptographic verification, authentication, authorization, logging, rollback protection, and strict package policies should work together.
MQTT Is Not the Villain
The protocol itself is not inherently malicious.
Implementation Determines Security
Any communication system becomes dangerous when authentication and authorization controls are weak.
Modular Malware Is Harder to Eliminate
The ability to download later stages means defenders may only discover one component while the attackers can replace others.
The Malware Can Change Faster Than the Vehicle
This is an important asymmetry.
Vehicles Have Long Lifecycles
Cars can remain on the road for many years.
Criminal Infrastructure Can Change Overnight
Attackers can change command servers, payloads, configurations, and monetization strategies rapidly.
That Mismatch Creates Risk
Automotive cybersecurity therefore has to account for threats that evolve much faster than the hardware itself.
The Proxy Angle Is Particularly Important
A compromised vehicle does not necessarily need to attack its owner’s data to cause harm.
It Can Become Someone
The
Reputation Can Become Collateral Damage
Traffic originating from compromised consumer devices can make attribution more difficult for investigators.
Manufacturers Need Better Visibility
If a head unit silently installs software, there should be a reliable mechanism for security teams to identify what happened.
Consumers Need Better Transparency
Vehicle owners should be able to understand what software is running on their cars.
Security Updates Should Not Be a Black Box
The same system that makes updating convenient should also provide evidence that the update is authentic.
Cars Need Software Supply-Chain Security
The automotive software supply chain is becoming as important as the traditional hardware supply chain.
One Compromised Component Can Have a Wide Reach
If an updater is distributed across thousands of vehicles, compromising that ecosystem could potentially scale an attack dramatically.
The Campaign May Be a Warning Shot
The current malware appears focused on monetization rather than vehicle control.
That Does Not Mean Future Threats Will Be the Same
Once attackers understand the platform, additional criminal groups may explore more aggressive capabilities.
Automotive Security Cannot Wait for a Disaster
Waiting for the first major vehicle-control incident before strengthening security would be a serious mistake.
The Industry Has an Opportunity Now
Manufacturers can build stronger isolation and authentication into future platforms before more sophisticated attackers arrive.
The Security Philosophy Must Change
A connected vehicle should be designed under the assumption that its software will eventually be attacked.
Resilience Matters as Much as Prevention
No security system is perfect.
Detection and Recovery Are Essential
Manufacturers should know when a component behaves abnormally and have a safe way to revoke, isolate, or replace compromised software.
The Most Important Lesson
The biggest warning from this incident is not that someone infected a car.
It Is That Someone Found a New Way to Make the Car Useful to a Botnet
That distinction matters.
The Future of Automotive Cybersecurity
As vehicles become more connected, the most valuable security boundary may no longer be the engine control unit.
It May Be the Entire Software Ecosystem
Infotainment systems, mobile applications, cloud platforms, update servers, dealerships, diagnostic interfaces, and third-party services are increasingly connected.
Every Connection Creates Responsibility
The automotive industry is entering a period where cybersecurity must become part of the vehicle’s architecture rather than an additional feature added afterward.
✅ Confirmed: First Documented Automotive Head-Unit Malware Case
Kaspersky described the discovery as the first documented case of malware found on an Android-based car head unit through an infection chain specific to that type of device.
✅ Confirmed: The Malware Used a Multi-Stage Architecture
The reported infection chain included an initial dropper, a second-stage loader, and additional payloads delivered from command infrastructure.
✅ Confirmed: The Campaign Used a Legitimate Update Component
The research identifies TWCore as the legitimate analytics and firmware-update application involved in the infection chain.
✅ Confirmed: Proxy Functionality Was a Major Objective
The deployed “zhima” component acted as a reverse proxy, indicating that the compromised vehicles were valuable primarily as network resources rather than direct driving-control targets.
✅ Confirmed: MoYu Group Attribution Was Reported With High Confidence
Kaspersky linked the campaign to MoYu Group based on malware naming clues and overlapping infrastructure associated with the BADBOX ecosystem.
❌ Not Established: Remote Control of the Vehicle’s Driving Functions
The reported campaign does not establish that attackers gained remote control over steering, brakes, acceleration, or other core driving functions.
❌ Not Established: Every Android Car Is Vulnerable
The discovery concerns a particular Android automotive environment and its update mechanism. It should not be interpreted as proof that every Android-based vehicle can be infected in the same way.
Prediction
(+1) Automotive Malware Research Will Accelerate
The discovery is likely to encourage researchers to investigate Android-based head units, update mechanisms, application permissions, and vehicle connectivity in greater depth.
(+1) Manufacturers Will Strengthen Update Security
Automotive companies are likely to place greater emphasis on cryptographic verification, signed packages, restricted installation privileges, and stronger authentication around remote update infrastructure.
(+1) Vehicle Networks Will Receive More Security Monitoring
As connected cars become recognized as valuable endpoints, network telemetry and behavioral detection will become increasingly important.
(+1) Criminals Will Continue Exploring Connected Consumer Devices
The economics of botnets strongly encourage attackers to search for new categories of devices that provide connectivity, processing power, and persistent uptime.
(-1) Automotive Systems Could Become Another Silent Botnet Layer
If manufacturers fail to secure update mechanisms and application-installation privileges, more vehicles could eventually be abused as invisible infrastructure for proxy networks, advertising fraud, credential attacks, or other cybercrime.
(-1) The Attack Surface Will Become Harder to Manage
Vehicles increasingly combine software from manufacturers, suppliers, cloud providers, application developers, telecommunications companies, and third-party services. Each additional dependency can create another security boundary that must be defended.
(+1) The Biggest Opportunity Is Prevention Before Scale
This incident is still a warning that the industry can act on. Strengthening update systems, isolating infotainment environments, restricting arbitrary APK installation, and monitoring abnormal network behavior could make future automotive botnet campaigns substantially harder to build.
Final Perspective: The Car Has Entered the Botnet Era
The most unsettling part of this discovery is not the idea that malware can run on Android.
That Problem Is Already Familiar
The real shift is that attackers have demonstrated a practical reason to compromise a vehicle that has nothing to do with stealing money from the driver’s phone or taking control of the steering wheel.
Connectivity Is the Commodity
A car can provide an internet connection, a persistent computing environment, and a place where malware can operate quietly.
That Is Enough to Attract Criminals
The DoFun head-unit campaign shows how quickly cybercriminals can move from familiar Android devices into new environments when the underlying economics remain attractive.
The Dashboard Is Now Part of the Security Perimeter
As vehicles become software-defined and permanently connected, cybersecurity can no longer stop at the smartphone, laptop, or router.
It Has to Reach Into the Car
The lesson is simple but profound: when a vehicle becomes a computer, every trusted update channel becomes a potential security boundary, and every connected component becomes something attackers may eventually try to monetize.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
