BADBOX-Linked Malware Infects Android Car Head Units via Firmware Updaters

What Kaspersky found

Kaspersky says it discovered the malware in June 2026 while investigating Android-based vehicle head units running firmware built by Chinese manufacturer DoFun. According to the vendor's technical writeup, this is the first malware family engineered around an infection chain specific to automotive infotainment hardware rather than phones, TV boxes, or generic Android devices. Kaspersky researcher Dmitry Kalinin summarised it plainly: "This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device."

How the infection chain works

The entry point is not a malicious app the driver installs — it's the unit's own update mechanism. TWCore (com.tw.core), a legitimate pre-installed system app that handles analytics and firmware updates, receives instructions from an MQTT message broker hosted on a cardoor[.]cn subdomain. Those messages can carry an installNotExists flag that pushes an unauthorised APK straight onto the device.

From there the chain runs in three stages. JarService is a UI-less dropper that decrypts an XOR-obfuscated payload and hands off execution. A second-stage loader profiles the device, reports back to a command-and-control server, and pulls down the final payload — Kaspersky logged firmware/config versions running from 3.57 through 3.68 across the samples. The third stage combines click-fraud logic with a reverse-proxy loader that deploys a module Kaspersky calls zhima, managed through an admin panel at admin.uipoxy[.]com. Between them, the samples support nine C2 commands, including remote code loading (loadlib2), arbitrary HTTP requests, WebView/JavaScript execution, and clipboard access. The malware checks in with its C2 roughly every 90 minutes by default.

Ad fraud and proxy monetisation, not vehicle control

Nothing in Kaspersky's writeup indicates access to CAN bus, telematics, or safety-critical systems — the payload's objectives are consistent with commodity mobile-ad-fraud and proxy-for-hire operations: generating fraudulent ad impressions and silently reselling the device's IP address as a residential proxy exit node. Kaspersky attributes the campaign with high confidence to MoYu Group, pointing to shared thread-naming conventions (mosdk-host-loader), a service name (AdmoyuService) also seen in set-top-box malware, and infrastructure overlap flagged separately by Nokia's Deepfield Emergency Response Team. MoYu Group is described as an affiliate within the broader BADBOX botnet ecosystem — the same family of operations that led Google to sue 25 Chinese entities in July 2025 over pre-installed malware on Android TV boxes and other budget devices.

Why it matters beyond this one vendor

Aftermarket and OEM-adjacent Android head units sit in the same low-margin, high-volume supply chain that produced BADBOX: white-label hardware, unaudited firmware, and update mechanisms built for convenience rather than integrity verification. An MQTT-driven updater that can silently push arbitrary APKs is functionally a second, unmonitored C2 channel — one that bypasses Play Protect and any app-store review entirely, because the update path itself is the trust boundary being abused. That pattern is not unique to cars; it's the same weakness that has repeatedly surfaced in cheap streaming boxes and tablets, now showing up in a device category with a much longer replacement cycle and far less security scrutiny.

What fleet operators and integrators can do

• Inventory aftermarket or third-party head-unit firmware in any fleet or vehicle-integration program, and confirm the update mechanism authenticates its source and payload before install.
• Treat any MQTT or push-update channel on an embedded Android device as untrusted infrastructure until its integrity controls are verified — don't assume 'it's a system app' means it's safe.
• Watch for anomalous outbound HTTP/MQTT traffic from infotainment or telematics network segments, particularly to unfamiliar domains at 90-minute intervals.