Android Car Head Unit Malware Exploits Firmware Updaters for Ad Fraud and Botnet Activities

A new malware family targets Android-based car head units via compromised firmware updaters, enabling ad fraud and proxy botnet activities. The threat, linked to the MoYu Group's BADBOX operation, exploits legitimate system apps to deliver malicious payloads through automotive software update mechanisms.

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun.

Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet.

"The malware spread through the built-in updaters of

Read original article