Clement Brako Akomea Table of Contents
Car head unit malware has been found for the first time spreading through the software update system built into a vehicle’s dashboard. Kaspersky researcher Dmitry Kalinin uncovered the Android threat in June 2026 while monitoring mobile malware, and traced it to firmware used in DoFun head units.
The malware installs silently, runs no visible app, and quietly turns infected dashboards into ad-fraud tools and relay points in a proxy botnet. Kaspersky attributes it with high confidence to the MoYu Group, an actor tied to the BADBOX botnet.
DoFun was notified of the distribution scheme and later reported fixing the security issues.
Car Head Unit Malware: Key Takeaway
The first known car head unit malware spreads through a dashboard’s own update system, enlisting Android vehicle units into an ad-fraud proxy botnet.
Tools that help you spot botnet-style activity on your network:
- Auvik — network monitoring that surfaces unusual outbound traffic from connected devices.
- Tenable — vulnerability management to find exposed and at-risk devices before attackers do.
- CyberUpgrade — cybersecurity management and compliance for smaller teams.
What the car head unit malware actually does
A head unit is the screen in the center of a dashboard that handles multimedia and some vehicle controls. Many run Android, because the platform is convenient for manufacturers and lets them add their own system apps during the build.
That openness is also the weakness. Most ordinary Android apps run on these units, and so does most Android malware. A dashboard rarely holds anything worth stealing, so the logical goal for an attacker is different: conscript the device into a botnet, much like attacks on other internet-connected hardware.
Kaspersky found precisely that. The infection is a multi-stage downloader whose end purpose is ad fraud and building a proxy botnet — a network of hijacked devices that route someone else’s internet traffic.
Why a dashboard is a useful target
Head units often include a SIM slot and a constant internet connection for navigation and updates. That always-on link is what makes an infected unit valuable as a proxy node. The device does not need to store anything sensitive to be useful; it only needs to stay online and pass traffic.
This mirrors the logic behind earlier botnets assembled from hacked consumer devices, where scale matters more than the value of any single machine.
How the infection reaches the dashboard
The entry point is a legitimate system app called TWCore (package name com.tw.core), which collects analytics and updates the head unit’s software.
TWCore receives update instructions through an MQTT message broker hosted on the subdomain cardoor[.]cn. Each message lists the APK files to download and install. Critically, the instruction includes a flag named installNotExists — when set, it lets TWCore install apps that were never on the device to begin with.
Attackers abused that flag. Kaspersky’s telemetry showed unknown malware being downloaded to TWCore’s own install path and installed by the com.tw.core process — the update mechanism itself delivering the payload.
Inside the three-stage attack chain
The malware unpacks in three deliberate stages, each handing off to the next.
Stage 1: the JarService dropper
JarService is a tiny dropper with no user interface at all — the trait that first flagged it as suspicious. It stores its next stage as XOR-encrypted blocks inside its own code, using a single-byte key that shifts from block to block, then decrypts and launches the payload.
Stage 2: the loader
The second stage reports the infected device to a command-and-control (C2) server, sending details such as a user ID, package name, and app version. The server replies with a download link for the third stage, which the loader decrypts and runs using Android’s reflection mechanism.
By altering the version number in the download link, researchers pulled seven distinct payload variants — evidence the operators have iterated on the chain over time.
Stage 3: the clicker and proxy loader
The final stage checks in with its C2 server roughly every 90 minutes, reporting the device model, screen resolution, Wi-Fi network name, and MAC address. Depending on the response, it can refresh its list of C2 servers or fetch new commands.
At the time of research, the operators had built nine commands supporting ad display, ad-fraud clicking, and downloading further code. In live attacks, though, they leaned on just two: http and loadlib2. The loadlib2 command pulls down the payload that matters most — a reverse proxy module called “zhima.”
The “zhima” proxy module
Zhima is what turns an infected dashboard into a botnet node, routing outside traffic through the vehicle. Researchers at the Nokia Deepfield Emergency Response Team independently found the same module running on TV set-top boxes at around the same time, reinforcing that the operators’ real aim is a large residential proxy network rather than any single device.
Who is behind the car head unit malware
Kaspersky tied the campaign to the MoYu Group through several threads. A loader thread was named mosdk-host-loader, and a related app on TV boxes (com.abc.nexus) contained a component named AdmoyuService. Combined with heavy overlap in network infrastructure — corroborated independently by Nokia Deepfield — those clues pointed to MoYu, one of the actors linked to the BADBOX platform documented by researchers at HUMAN Security.
The researchers also found the zhima admin panel at admin.uipoxy[.]com, which lets anyone register with a valid invite code. Its terms of service pointed to residential-proxy vendors PXYEDGE and ProxyForU, suggesting how the hijacked traffic is ultimately sold.
Everyday defenses for connected-device security:
Implications of car head unit malware
The dashboard is now part of the attack surface
For years, the main worries for head units were physical tampering and flaws in the unit’s operating system. This case adds a third route — the trusted update channel — and shows that a vehicle’s infotainment system is now a target in its own right, not just a curiosity. Connected cars join the same risk category as other Android devices that receive regular security patching.
Supply-chain trust is the weak point
The attackers did not break encryption or exploit a dramatic zero-day. They abused a legitimate feature — the installNotExists flag in a real update app. That makes this a supply-chain problem: when the update mechanism itself is the delivery vehicle, users have almost no way to notice, because nothing looks out of place.
Botnets are migrating to new hardware
BADBOX-linked actors have moved from set-top boxes to dashboards, proving they will follow any always-on, under-monitored Android device. As the pool of connected vehicles grows, so does the potential size of the botnet — and the harder it becomes to distinguish proxied malicious traffic from ordinary browsing. It echoes the remote-access concerns raised by connected-vehicle vulnerabilities like those found in Subaru’s Starlink system.
Detection and disruption are harder here
A phone user might notice battery drain or odd behavior; a driver almost certainly will not. Head units are rarely scanned, seldom updated by owners, and often left running whenever the vehicle is on. That combination gives this class of malware unusual staying power once installed.
Wrapping Up
Car head unit malware marks a clear expansion of the BADBOX ecosystem onto a device class no one was watching closely. By riding a legitimate update system, the MoYu Group turned ordinary dashboards into ad-fraud engines and proxy nodes without tipping off drivers.
The technical trick was simple — abuse a trusted install flag — but the consequences are broad. Infotainment systems now need the same malware defenses as phones and computers, and manufacturers must treat their update channels as security-critical infrastructure.
DoFun’s fix closes this specific route, yet the wider lesson stands: as vehicles grow more connected, attackers will keep probing every always-on Android device they can reach. Vigilance now belongs on the road as much as on the desktop.
Questions Worth Answering
What is car head unit malware?
- It is malicious software that infects the Android system running a vehicle’s dashboard (head unit), in this case to commit ad fraud and route botnet traffic.
How does the malware infect a car’s head unit?
- It abuses the built-in update app TWCore, which downloads and installs apps based on remote instructions — including a flag that allows installing software that was never on the device.
Who discovered the malware and when?
- Kaspersky researcher Dmitry Kalinin discovered it in June 2026 while monitoring Android threats, and detailed it on the company’s Securelist blog.
Who is believed to be responsible?
- Kaspersky attributes the activity with high confidence to the MoYu Group, an actor linked to the BADBOX botnet, based on naming patterns and infrastructure overlap.
What is the malware’s ultimate goal?
- To display ads, commit click fraud, and build a proxy botnet that routes third-party internet traffic through infected devices.
What is the “zhima” module?
- Zhima is the reverse proxy component that turns an infected head unit into a botnet node; the same module was independently found on TV set-top boxes.
Which devices are affected?
- The reported infections involved DoFun head units running Android-based firmware; related MoYu tooling has also appeared on TV set-top boxes.
Has the issue been fixed?
- DoFun was notified of the distribution scheme and reported fixing the security issues, closing this particular delivery route.
Can drivers tell if their dashboard is infected?
- Not easily — the malware has no user interface and runs silently, which is why manufacturer-level fixes and monitoring matter most.
Why are car head units attractive to botnet operators?
- They are always online through built-in SIM connectivity, rarely monitored or updated by owners, and powerful enough to serve as reliable proxy nodes.
