Hackers infect Android car head units with proxy botnet malware

# Your Car's Infotainment Screen Is Now a Proxy Node

The head unit in your dashboard manages navigation, Bluetooth, and — if you bought one of the millions of generic Android-based units running DoFun's firmware — apparently reports your Wi-Fi SSID and MAC address to a command-and-control server in China and moonlights as a residential proxy node while you're sitting in traffic.

Kaspersky researchers published findings this week on a supply-chain attack targeting Android car head units manufactured by DoFun, a Shenzhen-based automotive software and hardware company. The operation is attributed to MoYu, the same threat group behind the BadBox botnet — and if that name sounds familiar, it should. This campaign follows BadBox's well-worn playbook almost beat for beat.

## The Infection Chain Nobody Asked For

The attack vector is elegant in the way that supply-chain compromises always are: you didn't download anything malicious, didn't click a phishing link, didn't do anything wrong. The malware arrived through TWCore, a legitimate DoFun system application that handles device updates. TWCore received instructions via an MQTT broker at cardoor[.]cn and pulled down a rogue APK called JarService — which has no visible interface and no reason for a user to notice it exists.

From there, the execution unfolds in layers. JarService decrypts and runs a second-stage loader that phones home to a C2 server. The C2 delivers a final encrypted payload that runs persistently on the device, sending back device telemetry — model, display resolution, Wi-Fi SSID, MAC address — and waiting for commands.

Nine commands, specifically. The full list reveals what MoYu actually built here:

Kaspersky's analysis found that in practice, MoYu primarily deployed a reverse-proxy module called zhima — sesame, as in "open sesame" — to turn infected head units into proxy botnet nodes, alongside web request activity consistent with click fraud. The dual monetization is standard MoYu fare: sell proxy bandwidth through underground markets, generate fraudulent ad revenue on the side.

## BadBox With Wheels

The MoYu attribution matters here because it places this squarely in a documented pattern, not an isolated incident. BadBox infected hundreds of thousands of cheap Android devices — TV sticks, tablets, phones — by poisoning the firmware at or before the point of sale. The devices shipped already compromised, users never knew, and the botnet grew silently.

This campaign represents an evolution: instead of compromising firmware before shipment, MoYu found a live update mechanism to push malware post-sale. That's harder to block at the border and harder for manufacturers to detect. It also means a theoretically clean device can become infected weeks or months after purchase, which complicates forensics and attribution for anyone trying to figure out when their unit was compromised.

DoFun is described as selling "generic Android-based head units" — the kind of aftermarket infotainment systems that flood Amazon and AliExpress listings, often rebadged under dozens of brand names, all running the same underlying firmware. The actual installed base is unknown, but the market for these units is enormous. Budget head units with Android in the $80–$250 range are everywhere, particularly in older vehicles whose owners want CarPlay-style functionality without a new car payment.

Kaspersky says it notified DoFun, and the company responded that the problem has been resolved. What that means in practice — whether the malicious APK delivery has been cut off at the MQTT broker, whether a clean firmware update has been pushed, how many units remain infected — is unclear. DoFun has not made any public disclosure.

## What "Resolved" Doesn't Cover

The gap between "vendor patched the delivery mechanism" and "infected devices are clean" is where botnet operators live. Once zhima is running on a device, terminating the C2 infrastructure doesn't evict the proxy module. Devices already enrolled in the botnet remain enrolled until they're wiped or the malware is explicitly removed — which requires the owner to know something is wrong, which they almost certainly don't.

Car head units don't get the same scrutiny as phones or laptops. Owners don't run antivirus on them. There's no app store with review mechanisms. When the unit boots up and navigates correctly, users have no reason to suspect it's also handling proxy traffic for someone else's operation.

---

## HackWire Analysis

The headline here — "malware on car head units" — will generate attention because cars feel viscerally personal in a way that compromised routers don't. Kaspersky is right to note that the malware doesn't touch driving systems or vehicle safety controls. But the security community shouldn't let that assurance obscure what's actually significant about this campaign.

MoYu has now demonstrated that legitimate OTA update infrastructure for Android automotive devices can be weaponized with the same efficiency as consumer gadget firmware chains. The TWCore/MQTT vector isn't exotic — it's the same trust relationship every IoT device relies on to receive patches. The implication is that any automotive software vendor running similar update infrastructure is a potential target for the same technique. DoFun was just first.

The web command deserves more attention than it's received. Opening a URL in an embedded WebView and executing attacker-supplied JavaScript on an Android device with network access is not limited to ad fraud. That primitive could be used for session hijacking, credential harvesting via phishing overlays, or lateral movement into Wi-Fi networks the head unit is connected to — including home networks when the car is parked in the garage. MoYu appears to be using it for click fraud now, but the capability is broader than the current monetization play suggests.

For defenders, the practical response is uncomfortable: there's no reliable way for an end user to determine whether their aftermarket Android head unit is compromised. IT and security teams managing vehicle fleets should treat head units connected to any corporate-adjacent Wi-Fi as untrusted network devices and segment accordingly. For consumers, the blunt advice is to keep aftermarket Android head units on an isolated guest network — or avoid connecting them to your home network entirely.

The automotive supply chain is years behind mobile in security baseline expectations. This campaign won't be the last to exploit that gap.

— HackWire Editorial

---

## Related Coverage