Overview
- Kaspersky discovered the campaign in June 2026 and published technical findings on August 21–22, 2026 showing this is the first documented infection chain tailored to Android-based car head units.
- Attackers weaponized DoFun’s legitimate TWCore updater by using its MQTT broker hosted at cardoor.cn and the updater’s installNotExists flag to push APKs into the TWCore cache path /push/apk/ for silent installation.
- The malicious dropper called JarService decrypts and runs a loader that phones home, downloads staged payloads, and installs a clicker for ad fraud and a reverse-proxy module named zhima that turns head units into proxy nodes.
- Kaspersky links the operation with high confidence to the BADBOX ecosystem and the MoYu Group and found ties between the botnet operators and commercial services such as PXYEDGE and ProxyForU; DoFun says it has fixed the update-channel issue after being notified.
- Researchers say the malware so far does not affect vehicle control but it can slow or destabilize infotainment systems, consume bandwidth, and shows how internet-connected cars can be monetized like set-top boxes, raising risks for drivers and networks.