Hackers Are Using Fake Android Updates To Hijack Smart Car Displays
The discovered campaign basically disguises as legitimate software update mechanisms to covertly deploy backdoors, turning hijacked dashboard displays into unauthorized proxy relays and platforms for malicious activities. According to Kaspersky's report on the matter, the infection chain targets aftermarket and factory-installed head units running software from firmware developer DoFun. Rather than relying on tricking drivers into downloading malicious applications manually, the attackers breached the update channel of a legitimate system component called TWCore.
Responsible for collecting device telemetry and pushing OTA system updates via an MQTT server hosted on cardoor[.]cn, TWCore was manipulated through a configuration setting known as installNotExists. This allowed the server to quietly force-install arbitrary application packages, specifically a stealthy dropper labeled JarService, onto connected vehicles without triggering user prompts or UI notifications.
The multi-stage downloader then fetches secondary payloads, most notably a module named zhima with its primary objective of turning the infected infotainment system into a reverse proxy node. By routing external web traffic through the vehicle's active cellular or Wi-Fi data connection, threat actors can mask malicious online traffic, conduct automated click fraud, and lease residential proxy bandwidth to paying subscribers.
Investigative overlap in infrastructure, command structures, and internal code artifacts connects this automotive campaign to the MoYu Group, a threat actor affiliated with the notorious BadBox botnet. Historically known for infecting cheap Android TV streaming boxes and mobile devices straight from factory supply chains, BadBox operations have unfortunately expanded into automotive ecosystems to exploit persistent internet connections and low threat-monitoring coverage in cars. Kaspersky noted direct links between the campaign's command servers and administrative portals for commercial proxy platforms like ProxyForU and PXYEDGE.
After being notified by Kaspersky (that also runs the banned antivirus software), DoFun has reportedly addressed the vulnerability.
