Kaspersky found it in June 2026: previously unknown malware running on Android-based car head units powered by DoFun, in both factory-fitted and aftermarket units.

It is attributed with high confidence to the MoYu Group, which operates the BADBOX botnet for ad fraud and residential proxy services.

The delivery is the story

Nobody exploited anything. The malware arrives through the update channel.

The TWCore system app — com.tw.core — has a legitimate update mechanism that pulls APK files through an MQTT message broker at cardoor[.]cn, and a dropper Kaspersky calls JarService rides it. This is the path the head unit is built to trust: no user prompt to ignore, no sideloading to warn about, no permission dialog. Researchers counted 7 variants going back to version 3.57, so it has been carrying payloads for a while.

That makes it the same shape as the Rust crate poisoned at compile time and the Firefox extensions repurposed under their original IDs: the attacker does not defeat the trust decision, they inherit one already made.

What it does

Kaspersky reports 9 commands supporting unwanted advertising, ad fraud, and downloading further malicious modules. It also collects device information — display resolution, model, Wi-Fi identifiers and MAC addresses.

It checks for configuration updates every 90 minutes by HTTP POST to its command servers, which is frequent enough to retask the fleet within a working day and quiet enough that nobody looking at a data bill would notice it.

Why a car head unit is a good target

Better than it first sounds, and worse for the owner.

A head unit is a full Android computer with a screen the driver looks at, and its own SIM slot for connectivity. It is not tethered to your phone's data plan or your home Wi-Fi. It has an independent internet connection, in a moving vehicle, from a mobile network — which is exactly the profile a residential proxy operation wants, and the reason a device you never think of as a computer ends up carrying somebody's traffic.

Kaspersky also notes head units hold partial control over some vehicle functions. Nothing in this campaign touches that, and the distance between an advertising fraud module and vehicle controls is real. It is worth saying that the same code is running on the same board.

The unglamorous business behind it

Ad fraud and proxy resale are not headline crimes, which is precisely why they scale. Nobody calls the police because their infotainment screen served an advert to nobody at 3am, and the owner will never see a symptom beyond slightly worse battery drain and data usage they cannot itemise.

It is the same economics behind the Mirai variant that wanted routers for SOCKS5 rather than DDoS. Persistent, quiet, monetised per device.

What owners and manufacturers can do

Honestly, owners can do little, and that is the point worth making.

  • You cannot audit it. There is no app store review, no security patch level shown, and usually no way to know what version of anything the unit is running.
  • If the unit has a SIM slot you are not using, take the SIM out. A head unit with no independent connection cannot be reached or used as a proxy.
  • Watch the data bill on a connected car plan. Unexplained usage on a vehicle SIM is the one symptom an owner can actually observe.
  • Aftermarket units are the higher risk, because there is no manufacturer relationship at all and no update commitment.

For the industry the failure is structural: an infotainment supply chain where a system app can push APKs over an MQTT broker, with no signing story the owner can inspect. Kaspersky reports the issue enabling the abuse has been addressed after disclosure, without detailing how.

What is not established

  • How many vehicles are infected. No count or geographic breakdown has been published.
  • Which manufacturers or models are affected. Neither Kaspersky's report nor the coverage names them.
  • Whether vehicle functions were ever touched. Nothing reported suggests they were.
  • What "addressed" means. The remediation is stated, not described.