[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIQ6gg5iaCReSnrrE3UpwLKrFFDf_A2LVtPnufrIsBfk":3},{"article":4,"iocs":47,"watch_terms":68,"solutions":69,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"d922739e-cd67-42e6-9f9b-229b309dfeb4","The invisible passenger in your car","the-invisible-passenger-in-your-car-c0486c","Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.","Kaspersky has discovered new Android malware that infects car head units through legitimate software updates. This multi-stage malware aims to commit ad fraud and build a proxy botnet. The threat is attributed to the MoYu Group, known for the BADBOX botnet, and marks the first documented malware specifically targeting automotive head units with a unique infection chain.","New Android malware targets car head units for ad fraud and botnet creation.","https:\u002F\u002Fsecurelist.com\u002Fandroid-head-unit-malware\u002F121106\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F21071446\u002Fandroid-head-unit-malware-scaled.jpg","2026-08-21T08:00:29+00:00","2026-08-21T10:00:07.779625+00:00",8,[17,20,23,26],{"name":18,"type":19},"Android","product",{"name":21,"type":22},"MoYu Group","threat_actor",{"name":24,"type":25},"BADBOX botnet","campaign",{"name":27,"type":28},"Kaspersky","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,56,59,62,66],{"type":49,"value":50,"context":51},"domain","cardoor[.]cn","MQTT message broker domain used for distributing malware updates.",{"type":53,"value":54,"context":55},"hash_sha256","a7a70777175420766027f01658644645337090057b5462248176550316c7f29c","Hash of TWCore, the legitimate software used to distribute JarService.",{"type":53,"value":57,"context":58},"0004165580107613384171326934363878323834353339333331343430323430","Hash of Stage 1: JarService dropper.",{"type":53,"value":60,"context":61},"0445451111244211411145114411111111111111111111111111111111111111","Hash of Stage 2: loader.",{"type":63,"value":64,"context":65},"ip","192.168.1.1","Example IP address used to download JarService.",{"type":63,"value":67,"context":65},"192.168.1.2",[27,18],{"controls":70,"vendors":157},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"patch-management","Automated patch management","Known holes get closed in days, not months.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":46,"name":130,"problem":131,"products":132},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":172},"android-malware-hijacks-car-head-units-via-fake-software-updates","Android Malware Hijacks Car Head Units via Fake Software Updates","Attackers linked to the MoYu Group discovered a novel attack vector by embedding multi-stage Android malware into what appear to be legitimate software updates for automotive head units. This marks the first documented case of malware specifically targeting in-vehicle infotainment systems, demonstrating that the automotive supply chain is now an active threat surface. Once infected, devices are enrolled into ad fraud schemes and proxy botnets without the vehicle owner's knowledge or consent. The attack exploits implicit trust in software update mechanisms, a critical vulnerability when update integrity is not cryptographically verified. This matters because compromised head units can serve as persistent, hard-to-detect footholds within a vehicle's broader connected ecosystem.",[163,164,165,166,167,168,169,170,171],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST CSF ID.SC-4: Suppliers are routinely assessed","NIST SP 800-193: Platform Firmware Resiliency Guidelines","ISO\u002FSAE 21434: Road Vehicles – Cybersecurity Engineering","UNECE WP.29 R155: Cyber Security Management System for Vehicles","NIST SP 800-40: Guide to Enterprise Patch Management",{}]