First Documented Android Malware Targets Automotive Head Units for Ad Fraud

In June 2026, researchers monitoring Android threats uncovered a novel piece of malware that specifically targets automotive head units. This malware, which installs like a standard user application, notably lacks a user interface, raising suspicions that it may be infiltrating devices without user consent. Further investigation confirmed this hypothesis, allowing for a comprehensive reconstruction of the malware’s infection chain. This discovery marks the first documented case of malware targeting automotive head units, with the ultimate goal of ad fraud and the establishment of a proxy botnet.

Key findings from the research include:

• The identification of a multi-stage downloader malware designed for ad fraud and proxy botnet creation.
• The malware’s propagation through built-in updaters of Android-based automotive head unit firmware.
• High-confidence attribution of this activity to the MoYu Group, an actor associated with the BADBOX botnet.

Kaspersky’s detection solutions identify this malware under several names, including HEUR:Trojan-Dropper.AndroidOS.Agent.vu and HEUR:Trojan-Downloader.AndroidOS.Agent.ov.

Understanding Automotive Head Unit Firmware

Automotive head units serve as multimedia systems that also provide partial control over vehicle functions. These systems can be factory-installed or added as aftermarket upgrades. The primary attack vectors for head units include physical access and vulnerabilities within the operating system or components. Many head units operate on Android due to its flexibility, allowing manufacturers to customize system applications for various functionalities.

Interestingly, most Android applications, including malware, can run on these head units. However, certain types of malware, such as banking Trojans, are less likely to target head units due to the lack of valuable data. Instead, the malware discovered in this research exploits the head unit’s connectivity features, such as SIM card slots and internet access, to recruit devices into a botnet, similar to IoT device attacks.

The Role of the TWCore App

The legitimate TWCore application is responsible for collecting analytics data and updating head unit software. It utilizes an MQTT message broker hosted on the subdomain cardoor[.]cn to send messages about APK files that need to be downloaded and installed. A critical feature of this process is the installNotExists Boolean flag, which allows TWCore to install applications that are not originally present on the device.

Telemetry data revealed that the malware was consistently installed via an app with the package name com.tw.core, indicating a direct link to the TWCore application.

Stages of Infection

Stage 1: The JarService Dropper

The first stage involves the JarService, a small dropper app that operates without a user interface. It decrypts data stored within the Trojan’s code, which is encrypted in blocks using a linear XOR key. This decrypted data contains essential information about the payload version and entry point.

Stage 2: The Loader

The second stage features a malicious loader that executes the next payload using reflection. It sends device information to the attackers’ server via a POST request, receiving a link to download the subsequent payload in response.

Stage 3: Clicker / Reverse Proxy Loader

In the final stage, the malware sends periodic requests to the command and control (C2) server, providing device information and checking for configuration updates. The C2 server can return commands that enable the malware to display ads, commit ad fraud, and download additional malicious code.

Attribution to MoYu Group

Analysis of the malware’s infrastructure and naming conventions led researchers to attribute the activity to the MoYu Group, linked to the BADBOX malware platform. This attribution is supported by overlaps in network infrastructure and the discovery of similar malicious components across various devices, including TV set-top boxes.

Conclusion

This case highlights a sophisticated delivery method for malware, utilizing legitimate update mechanisms to infiltrate automotive head units. As attackers expand their reach into new platforms, it becomes increasingly vital for manufacturers to implement robust security measures to protect against such threats. The emergence of malware targeting automotive systems underscores the need for heightened vigilance in securing these increasingly connected devices.

For further details, you can read the full report by Kaspersky here.