SECURITY Signal 500
Multi-stage Android malware spread through DoFun head unit updater, researchers attribute to MoYu Group
↗
Kaspersky documented a multi-stage Android malware distributed through the built-in updater of DoFun automotive head units, which it attributes with high confidence to the MoYu Group behind the BADBOX botnet.
The infection abuses a legitimate system app that already has silent-install privileges, so ordinary Android install prompts never fire. Engineers building or auditing Android-based head units should treat any OTA updater that consumes remote instructions as a high-value target, not as inert plumbing. The same updater-as-dropper pattern is portable to any vendor whose update client trusts a server-pushed instruction, which makes this a template rather than a one-off.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Kaspersky reports the first documented case of malware using a car head unit's own update channel as the infection vector, specifically DoFun units running Android.
The legitimate TWCore system app (package com.tw.core) was coerced into installing a no-UI JarService dropper via MQTT instructions from cardoor[.]cn, with an installNotExists flag that bypasses the existing-app check.
The campaign is attributed to the MoYu Group with high confidence and is linked to the BADBOX botnet, with the malware's purpose being ad fraud and proxy botnet recruitment rather than vehicle compromise.
THE READ
What the cluster adds up to.
The concrete change is the infection surface: an Android-based head unit's own OTA update client became the delivery mechanism. The article traces the full chain but the structural finding for engineers is narrower than the stage-by-stage walkthrough. TWCore is described as a legitimate system app responsible for analytics and software updates, present on DoFun head units. The malware was observed in TWCore's own download directory and was installed by that exact package name, which is the strongest evidence that the updater itself, not a sideloaded app, drove the install. The novelty is not the malware family but the channel: a remote-instructed system updater pushing arbitrary APKs onto an embedded device. What made the attack work is a single design choice in the updater. TWCore consumes an MQTT message that describes which APKs to fetch and includes a Boolean installNotExists flag; the article notes TWCore only checks whether the app is already installed when that flag is false. Set the flag to true and the updater downloads and installs the APK regardless of prior state, with no UI and, because the installer is the preinstalled system app, no user-visible consent prompt. The
Where the finding stops generalising is in the specific vendor and updater. The infection chain was reconstructed for DoFun head units using the TWCore package, and the article says the vendor was notified and subsequently reported fixing the security issues. Whether other Android-based head units share a similar updater architecture is not established by the material, and the MQTT broker at cardoor[.]cn is specific to this campaign. Engineers porting this lesson should look for the pattern, a system-signed update client that accepts a remotely-pushed install instruction with a flexible overwrite flag, rather than assuming every Android head unit is exposed in the same way.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER