New Android Malware Targets Car Head Units for Ad Fraud and Botnet Creation

• •Malware targets Android-based car head units developed by DoFun.
• •Infection occurs through legitimate firmware update mechanisms using TWCore.
• •The malware aims to create a botnet for ad fraud and has been linked to the MoYu Group.

A new Android malware has been discovered targeting automotive head units, specifically those using firmware from the Chinese company DoFun. This malware exploits a legitimate system application, TWCore, to deliver a malicious app named JarService, which has no user interface and operates unnoticed. The malware aims to create a botnet for ad fraud, allowing attackers to execute commands such as displaying ads and downloading additional malicious code. Kaspersky identified this threat in June 2026, marking the first documented case of malware delivered via an automatic firmware-update service for car head units. The malware is linked to the MoYu Group, previously associated with the BADBOX botnet. DoFun has been notified and has reportedly fixed the security issues. This incident highlights the vulnerabilities in automotive systems that utilize Android software.