Kaspersky has documented the first known car head unit malware, a family that infects Android-based vehicle head unit firmware from DoFun and spreads through the head unit's own built-in software updater to run ad fraud and build a proxy botnet. Discovered in June 2026, it is, in researcher Dmitry Kalinin's words, the first documented case of malware found on a car head unit with an infection chain specific to that type of device. Kaspersky attributes the activity with high confidence to the MoYu Group, previously tied by HUMAN's Satori team to the BADBOX ad-fraud and residential-proxy scheme that drew a Google lawsuit against 25 China-based entities in July 2025.

A car head unit is the central console that blends multimedia with partial control of vehicle functions, factory-installed or fitted aftermarket, and increasingly Android-powered with a SIM slot for navigation and updates. That makes it a full Android target that also happens to sit inside a car. The infection abuses a legitimate system app, TWCore (com.tw.core), which normally collects analytics and pushes software updates as APK files using an MQTT message broker on a cardoor.cn subdomain. The attackers weaponized that trusted update channel to deliver a multi-stage downloader, dropping the payload into TWCore's own cache path for installation. After responsible disclosure, the issue driving the software-distribution abuse was addressed.

How does malware get onto a car's head unit?

Not through a phishing link or a sideloaded app, but through the update mechanism the device is built to trust. The starting point is TWCore, a preinstalled system app that fetches updates over MQTT and installs them as APKs. By compromising that distribution channel, the operators turned a routine over-the-air update into a malware delivery pipeline, which is why Kaspersky calls it a more sophisticated method than the pre-installed backdoors and trojanized IPTV apps seen in earlier automotive cases. The end payload enrolls the head unit into ad-fraud operations and a residential-style proxy botnet, monetizing the vehicle's connectivity without the driver's knowledge.

Why does a car head unit matter to enterprise defenders?

Because it is the same story as every other trust-the-updater supply-chain compromise, on a device class most asset inventories do not track. An Android head unit with a SIM is an internet-connected endpoint running standard apps, and its firmware update path is a software supply chain like any other. The lesson generalizes well beyond cars: any device that silently installs code from a vendor channel inherits the security of that channel, and BADBOX-style operators have shown they will target whichever channel is least watched.

Our read

This is a supply-chain compromise wearing an automotive costume, and the transferable lesson is about trusted update channels, not cars. When a vendor's own updater is the delivery mechanism, patching the endpoint is beside the point; the integrity of the distribution path is what actually protects the device. That maps directly to how we think about understanding risk: an organization's exposure is not just its servers and laptops but every connected device that accepts code from a vendor, from head units to IoT gateways. The practical takeaway is to inventory what can auto-update in your environment, ask who controls each of those channels, and treat a silent updater as an unmonitored ingress until you have verified otherwise.

Reporting by The Hacker News and SecurityWeek; technical detail and attribution per Kaspersky. Sources linked above.

Related: Software supply chain risk and Nexus Void understand risk.