# Your Car's Infotainment Screen Just Became a Botnet Node
The attack surface was always going to expand into vehicles. The only question was when the threat actors sophisticated enough to exploit it would show up. That moment arrived in June 2026, when Kaspersky researchers pulled malware out of Android-based car head units running DoFun firmware — and what they found was not a proof-of-concept. It was a production operation, fully attributed, with versioned payloads stretching back months.
The culprit is MoYu Group, the same crew behind BADBOX, a sprawling ad fraud and residential proxy scheme that HUMAN Security's Satori team exposed last year. Google was so alarmed by BADBOX's scale that in July 2025 the company filed a civil lawsuit against 25 unnamed China-based individuals for allegedly running its infrastructure. That lawsuit apparently didn't slow MoYu down much. They just expanded their target list to include your dashboard.
## How the Update Mechanism Became the Weapon
The technical elegance here is worth slowing down for, because it's different from how we usually see supply chain compromise play out.
The infection chain begins with a legitimate system app called TWCore — package name com.tw.core — which ships as part of the DoFun head unit firmware. TWCore's job is completely mundane: collect device analytics and push software updates over an MQTT broker hosted at a subdomain of cardoor[.]cn. Updates arrive as APKs, dropped into the device's external cache directory. It's a standard, functional auto-update pipeline.
MoYu weaponized that pipeline. They pushed a dropper called JarService through the same update channel, mimicking the legitimate update flow. Once installed, JarService launches a loader that phones home to attacker infrastructure, receives a URL for the next stage payload, and pulls it down. Kaspersky found the payload named with version strings — dex3.68.png — and by iterating version numbers in sequence, retrieved seven distinct variants going back to dex3.57. Someone has been actively developing this.
The final payload runs with no UI, invisible to the driver, and checks in with its C2 server every 90 minutes via HTTP POST to /cpc/api/task. It reports device information and its current configuration version. If the config is stale, the C2 pushes new addresses and request paths. Standard botnet hygiene, applied to something sitting under your steering wheel.
The end goals are ad fraud and enrolling the vehicle into a residential proxy network. The SIM card that car head units use for navigation and over-the-air updates provides a real mobile IP address — exactly the kind of exit node that proxy botnet operators charge premium rates for.
## Why Car Head Units Are the New Budget Android Tablet
If this feels like "someone put malware on a cheap Android device," that instinct is directionally correct but misses what makes automotive deployment different and worse.
Android-powered head units have proliferated across two distinct markets: factory installations in mid-range vehicles and aftermarket retrofits sold by the thousands on Amazon and AliExpress. Both categories share the same problem that plagued cheap Android TV boxes before BADBOX made them infamous — irregular patching cycles, firmware controlled by obscure ODMs, and users who have no mental model of their infotainment screen as a computer that needs security maintenance.
A driver who would never plug an untrusted USB device into a laptop will happily let their head unit's built-in updater pull software from wherever the OEM configured it. The update mechanism carries inherent trust. That's the assumption MoYu exploited.
The SIM card angle compounds the risk. Residential proxy value derives from the IP being associated with a real consumer location. A car's SIM address is tied to a physical vehicle registered to a real person — potentially an even more convincing "residential" identity than a stationary home router. And because the car moves, the IP rotates across geographic regions, making traffic patterns harder to correlate.
Following Kaspersky's disclosure, DoFun has reportedly addressed the distribution abuse in the TWCore update channel. But the broader question — how many other head unit ODMs have equivalent vulnerabilities in their update pipelines — remains unanswered.
## The BADBOX Playbook Isn't New, Just the Hardware
MoYu's methodology at this point has a clear fingerprint: find a category of always-on, SIM or internet-connected Android hardware with lax firmware security, compromise the update mechanism or factory image, deploy ad fraud and proxy capabilities, iterate quietly.
They ran this playbook on Android TV sticks. They ran it on IPTV boxes. Courts got involved and the operation barely flinched. Now they're in cars.
What's genuinely novel — Kaspersky explicitly calls it the first documented case — is the infection chain tailored specifically to head unit architecture. This wasn't a generic Android malware family ported opportunistically. JarService and the subsequent payload were built with the head unit update model in mind. That specificity suggests either that MoYu conducted real reconnaissance on DoFun's firmware before building the campaign, or that they had inside access to how the update pipeline worked.
Neither possibility is comfortable.
---
## HackWire Analysis
The automotive security community has been warning about this category of threat since connected head units went mainstream. What's striking about the MoYu campaign is not that it happened — it was predictable — but the operational maturity it reveals.
Seven payload versions. A versioned C2 configuration system with rotating addresses. A delivery mechanism that piggybacked on a legitimate OEM update channel rather than requiring any user interaction. This isn't a research team demonstrating theoretical risk; it's a profit-driven organization that invested real engineering effort into the automotive attack surface and has apparently been running the campaign for months before detection.
The BADBOX connection is significant context other outlets are underplaying. Google's lawsuit named 25 defendants, but BADBOX kept operating. Legal action against botnet infrastructure — even civil suits filed by a company with Google's resources — consistently fails to fully dismantle these operations. MoYu's expansion into car head units after the BADBOX exposure isn't a pivot; it's diversification. They're not retreating; they're adding inventory.
For defenders, the immediate action is narrowly scoped: organizations managing fleet vehicles with Android head units should audit which OEM update channels those devices use and whether those channels enforce code signing on delivered APKs. DoFun's specific issue is patched, but the category of vulnerability — unsigned or weakly-authenticated OTA delivery — is endemic across budget head unit firmware.
The harder problem is that most drivers have no mechanism to audit what their head unit is running. Unlike mobile phones, there is no app store policy, no OS vendor pushing security patches on a regular cadence, no notification system when firmware is updated. This is the same blind spot that let BADBOX persist across tens of thousands of TV boxes. Vehicles just raised the stakes.
Expect MoYu, or operations inspired by them, to probe other head unit ODMs. The attack surface just got proven out.
— HackWire Editorial
---
## Related Coverage