🚘 Malware takes over car stereos: Head units silently join a botnet
Your car's multimedia system is starting to look a lot like a regular computer. And like any computer, it carries the same risks. Kaspersky researchers recently uncovered malware hiding inside Android-based automotive head units built with DoFun firmware, quietly turning vehicles into nodes of a proxy botnet. Here's the unsettling part: drivers didn't need to download or tap anything. The infection happened automatically, through the very update mechanism the car was designed to trust.
🦠 How the infection works
The attack chain starts with TWCore, a legitimate system application on DoFun head units. It's supposed to handle analytics data and push software updates. Under normal conditions, TWCore receives instructions from the manufacturer's cloud about which APK files to download and install. But the update schema includes a flag called installNotExists, allowing it to deploy applications that were never present on the device before. Attackers exploited this feature to silently push a malicious dropper called JarService onto connected vehicles. No user prompt, no visible interface, nothing.
JarService is essentially an empty shell. It has no UI and makes no attempt to impersonate a legitimate app. Its sole job is to decrypt embedded payload data stored in XOR-encrypted blocks and launch the next stage: a loader that uses encrypted strings and Java reflection to execute the final component. This final piece connects to a command-and-control server every 90 minutes, sending device information such as model, display resolution, MAC address, and Wi-Fi SSID. The C2 server replies with integer command identifiers that the Trojan maps to specific actions.
☠️ What the malware actually does
The payload supports nine commands, including making HTTP requests, launching URLs in WebView instances, executing JavaScript, altering clipboard data, testing connectivity, and downloading additional modules. One particularly significant command, loadlib2, downloads and launches a reverse-proxy module called zhima. Once active, zhima converts the infected head unit into a traffic relay, allowing operators to route internet activity through the vehicle's connection.
This mirrors how residential proxy botnets work, where compromised endpoints provide geographically diverse egress infrastructure that can be monetized for fraud, scanning, and other malicious activity. Researchers also observed commands consistent with advertising abuse and click-fraud operations. Kaspersky identified seven distinct variants of the payload by trying different version numbers embedded in the file name, ranging from "3.57" up to "3.68".
❔ Who is behind it
Naming patterns, thread names in the code, and extensive infrastructure overlap point to the MoYu Group, a threat actor closely tied to the BADBOX botnet platform first documented by HUMAN Security in 2023. BADBOX has since infected more than one million Android devices worldwide, spanning phones, TVs, set-top boxes, and streaming sticks. Though German authorities disrupted part of the operation in late 2024, individual actors linked to it continue their activities. This campaign represents a clear expansion into automotive platforms.
DoFun, the Hong Kong based vendor supplying infotainment software for aftermarket head units and claiming to serve over 30 million vehicle owners globally, was notified by Kaspersky. The company reported fixing the underlying security issue in an infrastructure update.
😊 Follow us to stay informed about the latest threats and protect yourself.
#CarHacking #Botnet #AndroidMalware #DoFun #Cybersecurity
@PrivacyNotACrime 🗽 ⌨️ Chat
