New malware targets Android car head units for ad fraud and botnet creation

As reported by The Hacker News, a new malware family has been identified that specifically targets Android-based vehicle head unit firmware developed by DoFun, aiming to facilitate ad fraud and establish a proxy botnet.

Kaspersky discovered the threat in June 2026, noting that the malware spreads through the built-in updaters of the head unit firmware. This marks the first documented instance of malware with an infection chain tailored for car head units. The activity is attributed to the MoYu Group, previously linked to the BADBOX botnet. The malware exploits a legitimate system app, TWCore, to deliver a dropper named JarService, which then launches a loader. This loader communicates with a command-and-control server to download further malicious modules.

The malware supports commands for displaying ads, executing ad fraud, downloading additional malicious code, and gathering device information. It has been observed downloading a reverse proxy module known as "zhima."

Source: The Hacker News