Back Securityaffairs.Co

Malware Hijacks Android Car Head Units

Securityaffairs.Co •Pierluigi Paganini • August 22, 2026

Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Android Malware Targets Car Head Units for Ad Fraud and Botnet Creation A new Android malware has been discovered targeting automotive head units, specifically those using firmware from the Chinese company DoFun. This malware exploits a legitimate system application, TWCore, to deliver a malicious app named JarService, which has no user interface and operates unnoticed. The malware aims to create a botnet for ad fraud, allowing attackers to execute commands such as displaying ads and downloading additional malicious code. Kaspersky identified this threat in June 2026, marking the first documented case of malware delivered via an automatic firmware-update service for car head units. The malware is linked to the MoYu Group, previously associated with the BADBOX botnet. DoFun has been notified and has reportedly fixed the security issues. This incident highlights the vulnerabilities in automotive systems that utilize Android software. 19 sources 70

Extracted Entities

Malware Hijacks Android Car Head Units

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)