Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
thehackernews.com Aug 22, 2026

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

AI-summarised brief · reviewed before publication

Cybersecurity firm Kaspersky identified a new Android car‑head‑unit malware family in June 2026 that exploits built‑in firmware updaters of DoFun‑powered devices. The dropper, named JarService, hijacks the legitimate TWCore analytics app, which uses an MQTT broker at cardoor.cn to fetch APK updates, and installs a multi‑stage downloader that creates an ad‑fraud and proxy botnet. Researchers attribute the campaign with high confidence to the MoYu Group, previously linked to the BADBOX residential‑proxy scheme sued by Google in July 2025. The malware operates silently as a background app, reporting device details and receiving commands every 90 minutes to display ads, download modules, or act as a reverse proxy. Kaspersky disclosed the abuse, and DoFun has patched the update channel for future protection.

💡 Why It Matters

  • · By turning vehicle infotainment systems into ad‑fraud bots, attackers gain a mobile, always‑connected foothold that bypasses traditional PC‑centric defenses, exposing drivers to privacy breaches and new revenue‑draining scams.