# Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

> Kaspersky researcher Dmitry Kalinin discovered a novel Android malware family in June 2026 targeting DoFun car head unit firmware — the first documented case of malware with an infection chain specifically designed for automotive head units. The malware spreads through the legitimate TWCore system app's OTA update mechanism via MQTT, functioning as a multi-stage downloader enabling ad fraud and proxy botnet creation. Attributed with high confidence to MoYu Group, the threat actor behind the BADBOX 2.0 ecosystem.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-23T05:24:09.596Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2100
- **ID:** TL-2026-2100
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MoYu Group (China)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026, Kaspersky researcher Dmitry Kalinin identified a sophisticated multi-stage Android malware campaign targeting automotive head units manufactured by DoFun — a Chinese company that develops firmware, apps, and cloud services for Android-based car infotainment systems serving over 30 million vehicle owners worldwide. This represents the first documented case of malware specifically designed for and distributed through car head unit infection chains.

The infection vector exploits TWCore (com.tw.core), a legitimate system application pre-installed on DoFun head units responsible for collecting analytics and performing over-the-air (OTA) software updates. TWCore communicates with an MQTT message broker hosted at cardoor.cn to receive installation instructions. A Boolean flag called 'installNotExists' in the MQTT message allows TWCore to install applications that were not originally present on the device — a design feature that attackers weaponized to deliver the JarService Trojan dropper.

The malware operates across four stages. Stage 1 (JarService) is a small dropper APK with no user interface that contains XOR-encrypted payload blocks, each encrypted with a single-byte key that shifts linearly between blocks. The decrypted data reveals payload version information, an entry point class (wa method of com.c.j.qbh), and the next-stage loading code. Stage 2 decrypts runtime strings and uses Java reflection to invoke and execute Stage 3. It sends device information to the C2 server via an HTTP POST to obtain the next-stage payload URL (e.g., 144.217.243.201/vr34der34/dex3.68.png). Seven distinct payload variants were retrieved by Kaspersky through version number probing, with the earliest being version 3.57 using a different decoding algorithm.

Stage 3 operates as a clicker and reverse proxy loader, beaconing to the C2 endpoint /cpc/api/task every 90 minutes by default. The beacon payload includes device display resolution, model identifier, connected Wi-Fi SSID, MAC address, and the Trojan's configuration version. If the C2 determines the configuration is outdated, it returns updated C2 addresses (on .sbs TLD domains), new API paths, and interval settings — the most recent config version observed was 3.82. If new command identifiers (productId values) are present, the malware fetches their definitions from /cpc/api/xml.

The malware supports nine distinct commands stored as serialized JSON in SharedPreferences: return (retrieve stored values), copy (set clipboard contents), http (arbitrary HTTP POST/GET requests), web (open WebView and execute arbitrary JavaScript), loadlib2 (download and execute arbitrary code from a URL), deeplink (open browser URLs), and traceroute (ICMP ping checks). Commands loadlib and loadlib3 are not yet fully implemented. In observed attacks, only loadlib2 and http were actively used.

Through the loadlib2 and http commands, attackers deliver the zhima reverse proxy module — downloaded from URLs like 144.217.243.201/vr34der34/sh65.io with eight documented variants (earliest version 57). Zhima converts infected head units into residential proxy nodes by instantiating the module with C2 IPs (107.151.248.132, 128.14.210.58), proxy ports (1337/9999, 7777, 8888), and a 15-second timeout. The domain admin.uipoxy.com resolves to 128.14.210.58 and hosts the zhima administrative panel at /proxy/u/login, requiring an invite code for registration.

Kaspersky identified links between MoYu Group and two residential proxy services: PXYEDGE (pxyedge.com) and ProxyForU (proxyforu.com). Both offer residential proxy services that route paying clients' traffic through infected devices, and share identical API patterns — sign-in on admin.* subdomains at /proxy/u/login and signup at /proxy/register?channelKey=<invitation code>. Researchers assess these services are directly connected to MoYu Group.

The operation is attributed with high confidence to MoYu Group, previously exposed by HUMAN Security's Satori team as a key operator within the BADBOX 2.0 malware ecosystem — a massive botnet that infected over 1 million off-brand Android Open Source Project (AOSP) devices. In July 2025, Google filed a federal lawsuit in New York against 25 unnamed Chinese entities for operating BADBOX 2.0 under the Computer Fraud and Abuse Act and RICO Act. Despite multiple disruption efforts including a December 2024 sinkhole by Germany's BSI affecting ~30,000 devices and a March 2025 sinkhole of BADBOX 2.0 domains disrupting 500,000+ devices, individual actors continue their malicious activities.

Nokia Deepfield's Emergency Response Team independently confirmed the same zhima reverse proxy module on TV set-top boxes, corroborating the campaign's infrastructure expansion from Android TV devices into automotive platforms. Following responsible disclosure, DoFun reported fixing the security issues in their firmware update mechanism. However, Kaspersky warns that individual actors associated with the campaign continue infecting devices worldwide.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.005 Visual Basic
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1518 Software Discovery
- T1071.001 Web Protocols
- T1090 Proxy
- T1090.002 External Proxy
- T1219 Remote Access Tools
- T1587.001 Malware
- T1496 Resource Hijacking
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1554 Compromise Host Software Binary
- T1620 Reflective Code Loading
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1016 System Network Configuration Discovery
- T1115 Clipboard Data
- T1041 Exfiltration Over C2 Channel

## Sources

- [Android Car Malware Spreads Through Built-In Updaters](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html)
- [First Android malware targeting automotive head units (Securelist)](https://securelist.com/android-head-unit-malware/121106/)
- [Botnet on the road: the first trojan for car head units (Kaspersky Blog)](https://www.kaspersky.com/blog/car-botnet-malware-for-head-units-with-android/56296/)
- [BadBox-linked Android malware has now infected car head units](https://cyberinsider.com/badbox-linked-android-malware-has-now-infected-car-head-units/)
- [Google taking legal action against the BadBox 2.0 botnet](https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/)
- [Satori: Inside the Disruption of BADBOX 2.0](https://www.humansecurity.com/learn/blog/satori-disrupting-badbox-2/)
- [Google sues to disrupt BadBox 2.0 botnet infecting 10 million devices](https://www.bleepingcomputer.com/news/security/google-sues-to-disrupt-badbox-20-botnet-infecting-10-million-devices/)
- [Nokia Deepfield Public Research (zhima/ipmoyu)](https://github.com/deepfield/public-research)
- [Android Head Unit Malware Recruits Vehicles into Botnet](https://securityonline.info/android-head-unit-malware/)
- [Android Car Head-Unit Malware Linked to BadBox](https://www.technadu.com/kaspersky-finds-first-documented-android-car-head-unit-malware-using-firmware-update-mechanism-possible-links-to-badbox-botnet/633738/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2100