First Android malware found in car head units: Kaspersky uncovers ad-fraud botnet

Malware infects Android-based automotive head unit firmware

Kaspersky researchers discovered a new Android malware family that infects Android-based automotive head units through their built-in update mechanism. The multi-stage downloader, attributed to the MoYu Group (linked to the BADBOX botnet), performs ad fraud and creates a proxy botnet. This is the first documented case of malware with an infection chain specific to car head units. The infection spreads via the TWCore app, which can install arbitrary APKs, and involves three stages: a dropper, a loader, and a clicker/reverse proxy module. The malware can execute commands to display ads, commit ad fraud, and download additional code.