Security researchers have found a smart supply-chain attack. It has infected Android-based car head units with proxy botnet malware. This is the first known case of an infection chain built for these car systems. Kaspersky found it in June 2026. They say a group called MoYu carried it out. The attack uses a real device-update app to spread malware. It then turns the infected cars into a proxy botnet. The attackers use this botnet to make money through ad fraud. This guide covers how hackers infect Android car head units with proxy botnet malware in detail.
The attack targets head units made by DoFun. DoFun is a Chinese car software and hardware provider. It is owned by Shenzhen Driving Control Technology Co., Ltd. DoFun makes generic Android-based head units. These units act as the central command hub for a car's infotainment, navigation, and settings. Kaspersky researchers found a rogue APK file. It was being downloaded from TWCore, which is a real DoFun system app that handles analytics and firmware updates. The bad download came through an MQTT server hosted at cardoor[.]cn. It used a risky setting called `installNotExists` in the update protocol. This flag lets the updater install apps that are not already on the device, without asking the user.
Hackers infect Android car head units with proxy botnet malware: How Does the Malware Infiltrate and Operate?
The first bad app is called JarService. It runs without a user interface and does not try to hide itself. This suggests that it gets installed without the user knowing. Once it launches, JarService decrypts and runs a second-stage loader. This loader connects to a command-and-control (C2) server. The loader then downloads another encrypted payload. This payload regularly sends device info to the attackers, such as the model, display resolution, Wi-Fi SSID, and MAC address.
The malware has a set of nine commands it can run. These commands let it carry out many harmful actions. They include reading values from Android's SharedPreferences storage, copying content to the clipboard, sending HTTP GET or POST requests, opening URLs in a WebView to run JavaScript, and checking if the network is reachable through ICMP ping. Most importantly, the `loadlib2` command lets the malware download and run any code or extra modules. Researchers saw this command used to deploy a reverse-proxy module called 'zhima'.
The 'zhima' module is at the heart of what the attackers want to do. They turn the infected car head units into residential proxy nodes. They also use them for ad fraud, mainly click-fraud. Kaspersky says with high confidence that the MoYu group did this. MoYu has a track record of such attacks. They are closely linked to the BadBox malware botnet and the IpMoYu residential-proxy service. The BadBox 2.0 botnet, which MoYu Group built, has infected over a million Android devices before. It often did so through supply-chain attacks or bad apps. The malware uses some of the head unit's computing power. This can lead to slower infotainment systems or weaker internet speeds. Kaspersky points out that it does not interfere with driving or critical vehicle control systems. Whether you are new to hackers infect Android car head units with proxy botnet malware or already experienced, the sections below have you covered.
What This Means for Tech Readers
This incident shows a serious and growing threat. Even specialized car systems are now targets for cybercriminals. For tech fans and everyday consumers, it points to the built-in risks in the growing world of connected devices. The fact that a real update tool was used to deliver malware is especially worrying. It gets around the usual user habit of watching out for bad downloads. It shows that supply-chain attacks are not just for business software or consumer electronics. They now reach the cars we drive. The way the attackers make money also reveals their range of motives. They use residential proxy networks and ad fraud. They move past just stealing data. Instead, they use device resources for illegal gains. This incident is a strong reminder that strong security practices matter. These include watching software supply chains closely and patching security holes fast. They are key for makers. For users, being careful with aftermarket installs and knowing where their device's firmware updates come from is more important than ever.
What's Next in Automotive Security?
The finding of the MoYu group's campaign against Android car head units suggests that car security will become a more important focus area. As cars get more connected and link up with digital systems, they give cybercriminals new ways to attack. Makers like DoFun, who have reportedly fixed the issue, will need to put stronger security measures in place. They need to add them across their software build and update pipelines. This will help stop similar attacks. Future changes may include better secure boot tools, stricter code signing rules, and ongoing threat monitoring built for car infotainment systems. The wider security community will likely see more research into the weak spots of embedded Android systems in cars. This will lead to better detection and prevention tools. Consumers can expect more openness from makers about software security and update safety in their connected cars. The ongoing fight against botnets like BadBox and groups like MoYu will keep pushing the limits of security. It will call for active and adaptive defenses across all connected platforms.
Related Resources
For more context, check our related guides.
