Hackers infect Android car head units with proxy botnet malware

**Executive summary:** Kaspersky researchers uncovered a supply-chain compromise of DoFun Android head-unit software that delivered a multi-stage malware named JarService attributed to the MoYu group; the final payload registers device details, supports multiple remote commands, and primarily loads a reverse-proxy module (zhima) to enlist infected head units into a proxy botnet and carry out click-fraud, while not affecting vehicle control systems.