A newly uncovered Android malware campaign has turned car infotainment screens into an unexpected target.

Rather than tricking drivers into installing a suspicious app, attackers used the software update path already built into Android-based head units.

The malware is a multi-stage downloader for ad fraud and a proxy botnet. It targets connected vehicle screens that handle music, navigation, and some vehicle functions, exploiting the same internet access that enables routine software updates.

That makes a trusted maintenance feature the entry point for a wider criminal operation. Analysts at Securelist identified the malware while monitoring Android threats in June 2026 and reconstructed the full infection chain.

Researchers called it the first documented head-unit malware using a device-specific infection route and attributed it to the MoYu Group, linked to BADBOX.

Securelist said in a report shared with Cyber Security News (CSN) that the affected firmware design enabled the distribution, while the vendor reported that it had fixed the security issues. The finding expands concern beyond phones and televisions, as connected screens become standard in vehicles.

Hackers Infect Android Car Screens

The attack centers on TWCore, a legitimate system application that collects analytics and updates head-unit software.

An MQTT broker on the cardoor[.]cn infrastructure sent details of APK files for download. A setting called installNotExists could instruct TWCore to install an app that was not originally on the device, creating the opening for the malicious package.

Telemetry showed the unknown malware being placed in TWCore’s update cache and installed by the com.tw.core package.

The first component, JarService, has no user interface. It decrypts embedded data and starts the next payload, keeping the infection out of a driver’s view.

A second-stage loader then reports device information to an attacker server and receives a link for the next component.

The third stage checks in at regular intervals, collects information such as the device model, display resolution, Wi-Fi network name, and MAC address, then receives fresh configuration data or commands.

This chain differs from familiar phone scams because it does not begin with a fake text, a malicious advert, or an app-store lure.

Earlier BADBOX Android device infections showed how compromised firmware can expose connected devices before users realize anything is wrong. The new case moves that risk directly into the vehicle environment.

From Screen to Proxy Network

The final payload can display advertisements, generate fraudulent clicks, download more code, and open web content in the background.

Researchers found that operators were using commands to fetch a reverse-proxy module named zhima, allowing an infected head unit to relay traffic for someone else. This turns a car screen into part of a hidden network.

The attribution rests on malware naming, shared infrastructure, and overlap with previous activity tied to MoYu Group. The researchers also linked the operation to a malicious TV-box app and noted common infrastructure with campaigns associated with BADBOX.

Readers can compare the pattern with Vo1d Android TV botnet, which also demonstrated the scale that connected Android devices can offer attackers.

The report does not show the malware directly controlling steering, braking, or other safety-critical systems. Still, any compromised infotainment device can create privacy, connectivity, and trust problems.

The wider automotive risk is clear from a Nissan Leaf infotainment flaw, where researchers described how a separate weakness could lead from an in-car system toward vehicle functions.

Owners should install only updates supplied through verified manufacturer or dealer channels, ask whether their head unit has received the relevant security fix, and avoid connecting unknown software or USB media.

Manufacturers should restrict update services to signed packages, validate every remote instruction, and keep a clear way to revoke malicious updates.

That is essential when a dashboard screen is also an internet-connected computer. They should also monitor manufacturer advisories and report unexplained app installations, network prompts, or system behavior quickly.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC