Back Scworld

New malware targets Android car head units for ad fraud and botnet creation

Scworld • August 21, 2026

As reported by The Hacker News, a new malware family has been identified that specifically targets Android-based vehicle head unit firmware developed by DoFun, aiming to facilitate ad fraud and establish a proxy botnet.

Kaspersky discovered the threat in June 2026, noting that the malware spreads through the built-in updaters of the head unit firmware. This marks the first documented instance of malware with an infection chain tailored for car head units. The activity is attributed to the MoYu Group, previously linked to the BADBOX botnet. The malware exploits a legitimate system app, TWCore, to deliver a dropper named JarService, which then launches a loader. This loader communicates with a command-and-control server to download further malicious modules.

The malware supports commands for displaying ads, executing ad fraud, downloading additional malicious code, and gathering device information. It has been observed downloading a reverse proxy module known as "zhima."

Source: The Hacker News

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Android Malware Targets Car Head Units for Ad Fraud and Botnet Creation A new Android malware has been discovered targeting automotive head units, specifically those using firmware from the Chinese company DoFun. This malware exploits a legitimate system application, TWCore, to deliver a malicious app named JarService, which has no user interface and operates unnoticed. The malware aims to create a botnet for ad fraud, allowing attackers to execute commands such as displaying ads and downloading additional malicious code. Kaspersky identified this threat in June 2026, marking the first documented case of malware delivered via an automatic firmware-update service for car head units. The malware is linked to the MoYu Group, previously associated with the BADBOX botnet. DoFun has been notified and has reportedly fixed the security issues. This incident highlights the vulnerabilities in automotive systems that utilize Android software. 19 sources 70

Extracted Entities

New malware targets Android car head units for ad fraud and botnet creation

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)