The invisible passenger in your car

This report describes the June 2026 discovery of a novel multi-stage Android malware campaign that leverages the built-in updater of Android-based automotive head units (TWCore) to silently install a UI-less dropper (JarService) which retrieves staged loaders and a zhima reverse-proxy module used for ad fraud and building a proxy botnet; the activity is attributed with high confidence to the MoYu Group (BADBOX) and includes detailed TTPs, C2 examples, hashes, domains, IPs, download URLs, and notes that the vendor remedied the distribution mechanism.