First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet

A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a residential proxy botnet.

The activity, discovered in June 2026, is the first documented malware infection chain purpose-built for automotive head units and has been attributed with high confidence to the MoYu Group, an actor linked to the BADBOX ecosystem.

The campaign targeted multiple DoFun-powered Android head units through TWCore, a legitimate privileged system application used for device analytics and software updates.

TWCore receives APK installation instructions from an MQTT broker associated with cardoor[.]cn.

Its update schema includes an installNotExists Boolean value, enabling it to deploy applications that are not already installed on the unit an intended feature that attackers abused to deliver a malicious APK silently.

Telemetry showed that TWCore downloaded and installed an unknown, headless application named JarService. The package contains no UI and does not attempt to impersonate a legitimate consumer app.

JarService serves as the first-stage dropper. It decrypts embedded payload data stored in XOR-encrypted blocks, with the single-byte decryption key changing sequentially between blocks.

The decrypted content contains versioning data, an entry point, and code required to load the next payload.

The second stage is a loader that uses encrypted strings and Java reflection to execute the final component.

It posts implant metadata including package name, application version, channel identifier and loader version to command-and-control infrastructure. The C2 then returns a dexUrl hosting an encrypted stage-three payload.

The third-stage component polls the attackers’ /cpc/api/task endpoint approximately every 90 minutes.

It reports host intelligence such as display resolution, device model, Wi-Fi SSID and MAC address, while receiving updated C2 hosts, task paths and command configurations.

The architecture gives operators a flexible remote execution framework rather than a single-purpose implant.

The malware supports commands to make HTTP requests, launch URLs in WebView instances, execute JavaScript, alter clipboard data, test connectivity and retrieve arbitrary modules.

According to Kaspersky Researchers, DoFun was notified of the update-channel abuse and said the underlying issue has been fixed.This characteristic helped expose its covert delivery through the system updater.

The most significant observed command, loadlib2, downloads and launches additional code with attacker-controlled parameters and integrity hashes.

Android malware campaign

Operators used loadlib2 to deploy a reverse-proxy module called zhima. Once active, the component converts the infected head unit into a traffic relay, allowing customers or operators of the proxy service to route internet activity through the vehicle’s connection.

This model mirrors residential proxy botnets, where compromised endpoints provide geographically diverse egress infrastructure that can be monetized or abused for fraud, scanning and other malicious activity.

Researchers also observed commands consistent with advertising abuse and click-fraud operations.

The same zhima component was independently identified on TV set-top boxes by Nokia Deepfield researchers, reinforcing the assessment that the campaign is part of a broader device-monetization operation rather than an attack focused on vehicle control systems.

Available reporting indicates the malware was designed to exploit internet-connected infotainment hardware, not interfere with driving or safety-critical vehicle functions.

Kaspersky linked the operation to MoYu through the loader thread name mosdk-host-loader, code similarities with malware on TV set-top boxes, and overlap in network infrastructure.

The researchers also identified connections among proxy-management infrastructure and services associated with residential-proxy brands, supporting the assessment that compromised head units were being incorporated into a commercially useful proxy network.

Kaspersky detects the campaign under HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.*, and HEUR:Trojan.AndroidOS.Vo1d.*.

The incident expands the BADBOX-linked threat model beyond phones, TVs and set-top boxes: automotive Android platforms now present a viable target for botnet operators when their privileged update paths can install arbitrary APKs.

Indicators of compromise

Domain / IP address	Indicator
xmsae[.]sbs	Domain
ishano456[.]sbs	Domain
xshaon123[.]sbs	Domain
kshahnd[.]sbs	Domain
mdsjhd[.]sbs	Domain
nmnsny[.]sbs	Domain
kookjar[.]com	Domain
ty54fgd435[.]my	Domain
ue886578433[.]online	Domain
ty4523[.]space	Domain
144.217.243[.]201	IP address
107.151.248[.]132	IP address
128.14.210[.]58	IP address

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide