The invisible passenger in your car

Attackers linked to the MoYu Group discovered a novel attack vector by embedding multi-stage Android malware into what appear to be legitimate software updates for automotive head units. This marks the first documented case of malware specifically targeting in-vehicle infotainment systems, demonstrating that the automotive supply chain is now an active threat surface. Once infected, devices are enrolled into ad fraud schemes and proxy botnets without the vehicle owner's knowledge or consent. The attack exploits implicit trust in software update mechanisms, a critical vulnerability when update integrity is not cryptographically verified. This matters because compromised head units can serve as persistent, hard-to-detect footholds within a vehicle's broader connected ecosystem.