Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

The MoYu Group exploited trusted, built-in software update mechanisms in DoFun-manufactured Android vehicle head units to silently deliver multi-stage malware, turning a trusted process into an attack vector. Because the malware abuses a legitimate system app (TWCore), it bypasses typical user-level security scrutiny and can persist with elevated privileges. This attack mirrors the BADBOX scheme, demonstrating that embedded Android devices in non-traditional form factors — such as automotive systems — are increasingly targeted and often lack the security oversight applied to phones or enterprise endpoints. The consequences extend beyond individual vehicles, as compromised devices are enrolled into proxy botnets and ad fraud networks, generating financial harm at scale.