Cybersecurity experts have identified a new malware strain targeting Android-based car head units, posing a significant threat to automotive security. Kaspersky researchers first detected this malware in June 2026, noting its function as a multi-stage downloader designed for ad fraud and proxy botnet creation.
Malware Targets Android Car Systems
This malicious software infiltrates systems through the built-in update mechanisms of Android car head unit firmware, particularly those developed by DoFun. According to security researcher Dmitry Kalinin, this marks the first documented instance of malware specifically tailored to infect car head units.
The MoYu Group, previously exposed by HUMAN Satori Threat Intelligence and Research, is believed to be behind this attack. This group is associated with the broader BADBOX ad fraud and proxy scheme, which led to a Google lawsuit in July 2025 against various unnamed entities in China.
Infection Through Software Update Exploitation
The malware exploits the update systems of Android automotive head units, which serve as multimedia and control hubs in vehicles. These systems, prevalent in both factory-installed and aftermarket settings, are increasingly targeted due to their internet connectivity capabilities.
Kalinin highlights the sophisticated delivery method employed, which involves the misuse of legitimate system app functionalities to distribute the malware. The update mechanism uses the MQTT message broker hosted on “cardoor[.]cn” to download APK files to the “/push/apk/” directory for installation.
The attackers utilize a dropper named JarService to deploy malware, which sends implant data to a server and retrieves further payloads. This operation allows the malware to run covertly, without a user interface, by communicating with a command-and-control (C2) server every 90 minutes.
Impact and Continued Threats
With the ability to execute nine distinct commands, the malware performs actions ranging from displaying ads to downloading additional malicious software. It can also gather detailed device information, making it a versatile tool for cybercriminals.
Despite efforts to dismantle the BADBOX network, individuals linked to it persist in their activities, affecting devices globally. The malware’s unique focus on car head units highlights the urgent need for enhanced security measures in modern automotive systems.
As this threat evolves, automotive manufacturers and cybersecurity professionals must prioritize robust defenses against such malware to protect vehicle systems from exploitation.
