As of August 2026, security researchers have uncovered the first known malware infection targeting Android-based automotive head units. Discovered by Kaspersky in June 2026, the multi-stage downloader targets firmware developed by DoFun to establish a proxy botnet and execute ad fraud. The malicious code spreads directly through legitimate vehicle update channels.
Inside the DoFun Head Unit Firmware Exploitation
Modern vehicles increasingly rely on Android-based infotainment and control systems for practical manufacturing reasons. Vendors can easily build upon existing source code and bundle custom system apps during production. However, that architectural flexibility introduces profound security liabilities. Because these head units are fundamentally standard Android computers under the hood, they can execute standard application packages (APKs) originally designed for mobile phones.
Kaspersky analysts identified a malicious Android app operating with zero user interface. The software made no attempt to masquerade as a legitimate consumer application, instead embedding itself directly into the device’s update mechanism. Typically responsible for analytics and firmware updates on DoFun head units, TWCore relies on an MQTT message broker to receive instructions regarding which APK files to download and install.
A specific configuration flag within the system, designated as installNotExists, dictates whether the application checks if a target software package is already present before pushing an update. When attackers manipulate this parameter to false, the system bypasses its usual verification checks. This effectively transforms a routine maintenance channel into a silent installation pipeline for arbitrary payloads.
The Multi-Stage Payload and Command-and-Control Architecture
Once the system channel is forced open, the attack deploys a lightweight dropper known as JarService. This component lacks any user interface entirely, serving solely to decrypt and execute the next phase of the intrusion. According to security documentation analyzed by SC Media, the payload infrastructure is attributed to the MoYu Group, a collective previously linked to the widespread BADBOX botnet.
The secondary loader immediately initiates outbound communication with a command-and-control (C2) server. It transmits basic system Telemetry, including device metadata, before requesting the final payload module. Researchers observed that this third-stage module could be pulled in at least seven distinct variations by cycling through version numbers in the download URL.
The primary payload establishes a persistent reverse proxy and clicker component designed to run continuously in the background. By default, the malware transmits an HTTP POST request to the endpoint /cpc/api/task every 90 minutes. Contained within this routine check-in are comprehensive device diagnostics:
- Display resolution and device model identification
- Service Set Identifier (SSID) of the currently connected Wi-Fi network
- Hardware MAC address and local network configuration
- Active Trojan configuration version
If the C2 server determines that the local configuration is outdated, it responds with updated routing instructions. These responses deliver new server addresses and alternative endpoints for subsequent HTTP requests, ensuring persistent access even if initial infrastructure is blocked.
Ecosystem Realities and the Risks of Unvetted Automotive OS Implementations
While banking trojans or mobile spyware would find little utility on an in-car infotainment display, the hardware’s permanent network connection and computational capacity make it an ideal asset for infrastructure abuse. Turning compromised automotive head units into nodes for a proxy network allows threat actors to route malicious traffic, monetize ad impressions through automated click-fraud, and obscure illicit web scraping operations behind legitimate residential IP space.
The discovery highlights structural vulnerabilities in how automotive manufacturers adapt consumer operating systems for industrial environments. When firmware supply chains lack rigorous cryptographic validation for internal system updates, compromise at the component-manufacturer level propagates directly to end-user vehicles. As vehicle architectures continue to converge with standard computing stacks, securing the underlying update broker remains an urgent engineering priority for the automotive sector.
