BadBox-linked Android malware has now infected car head units

Android malware is spreading through the built-in firmware update mechanism of automotive head units, turning the devices into nodes for ad fraud and a residential proxy botnet.

Kaspersky reports this is the first documented malware campaign with an infection chain specifically designed around car head units.

Kaspersky researcher Dmitry Kalinin discovered the activity while monitoring Android threats in June 2026. Investigators initially noticed an unusual Android application called JarService that installed like a normal app but had no interface and made no attempt to impersonate legitimate software, suggesting users were not installing it themselves.

Kaspersky traced the infections to TWCore, a legitimate system application used on DoFun Android automotive head units for analytics collection and software updates. These head units provide multimedia, navigation, connectivity, and limited vehicle-related functionality, and may be installed by automakers or sold as aftermarket upgrades.

According to the researchers, TWCore receives update instructions through an MQTT server on the cardoor[.]cn domain and can download and install APK packages. One available setting, installNotExists, allows the updater to install applications that were not already present on the device.

Kaspersky telemetry showed JarService repeatedly appearing in TWCore's APK download directory and being installed by the com.tw.core package. The researchers notified DoFun about the distribution mechanism, and Kaspersky says the vendor subsequently reported fixing the security issues involved.

Once installed, JarService launches a multi-stage infection chain. An intermediate loader contacts an attacker-controlled command-and-control server and retrieves another payload, which periodically reports information about the head unit, including its model, screen resolution, connected Wi-Fi network, and MAC address.

That component can receive commands to open web pages, execute JavaScript, make HTTP requests, manipulate clipboard data, and download additional code. While the framework supports several functions, Kaspersky observed attackers primarily using it to install a module called zhima.

Zhima turns infected devices into reverse proxies, allowing other traffic to be routed through their internet connections. Researchers from Nokia's Deepfield Emergency Response Team independently found the same malware family on TV set-top boxes, supporting Kaspersky's conclusion that the broader operation is designed to create a proxy botnet. The malware can also support automated advertising activity and click fraud.

Kaspersky attributes the campaign with high confidence to MoYu Group, an actor previously associated with the BADBOX malware ecosystem. The attribution is based on naming artifacts inside the malware, similarities with malicious software found on set-top boxes, and substantial overlap in network infrastructure.

The investigation also connected one zhima server to admin.uipoxy[.]com, where researchers found a proxy administration panel. Registration pages referenced privacy and usage documents belonging to a residential proxy provider.

The discovery shows that Android-based vehicle systems face many of the same supply-chain and update-channel risks as phones and IoT devices. Owners and installers should apply vendor security updates, avoid unsupported firmware builds, restrict unnecessary internet connectivity where practical, and investigate unexpected applications or network activity on Android head units.