Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Kaspersky researchers uncovered a multi-stage malware campaign targeting DoFun Android automotive head units by weaponizing the legitimate TWCore updater to deploy a dropper (JarService) and downloader that installs a background-only app used for ad fraud and to create a proxy botnet; the activity is attributed to the MoYu Group linked to BADBOX, includes identifiable C2 endpoints and commands, and was mitigated after responsible disclosure.