Hackers infecting Android car systems to build proxy botnet

Kaspersky found a new malware campaign targeting DoFun Android head units that abuses a system updater (TWCore) to silently install a downloader app (JarService), turning infected car infotainment systems into ad-clicking bots and reverse proxies as part of a BadBox/MoYu Group botnet; the vendor was notified and fixes were reported.