Malware Hijacks Android Car Head Units

Kaspersky researchers uncovered the first documented malware campaign targeting Android-based car head units, which abused a legitimate updater (TWCore) to push a multi-stage dropper (JarService) and loader that fetches payloads including a reverse proxy module ('zhima') to add infected vehicles to the BADBOX proxy network; the activity is attributed to MoYu Group and demonstrates attackers leveraging firmware update channels to scale a proxy botnet using cars' Internet connections.