Cybersecurity researchers have uncovered a new Android malware variant that leverages legitimate firmware update mechanisms in car head units to establish a proxy botnet. The malware, dubbed BADBOX by researchers, was first identified in June 2026 and represents the first documented instance of malware specifically targeting automotive infotainment systems through their native update channels.
The infection chain begins within TWCore, a legitimate system application responsible for analytics and firmware updates on DoFun head units. Attackers manipulate an MQTT message broker to send instructions to TWCore, directing it to download and install malicious APK files. A critical configuration flag, `installNotExists`, when set to `true`, bypasses checks for existing installations, transforming the routine update process into a silent installation pipeline for attacker-controlled software.
The initial payload, a small dropper named JarService, operates without a user interface. Its sole function is to decrypt and load the subsequent stage: a loader. This loader communicates with a command server, transmitting basic device information and receiving a download link for the final payload. Researchers observed at least seven different versions of this third-stage module, which can be retrieved by altering version numbers in the download URL.
The ultimate payload is a clicker and reverse proxy component. This module checks in with its command-and-control (C2) server every 90 minutes by default, sending a POST request to `/cpc/api/task`. This request includes device details such as display resolution, device model, Wi-Fi SSID, and MAC address, along with the Trojan's configuration version. If the configuration is outdated, the C2 server provides an updated configuration with new C2 addresses and HTTP request paths.
The command system supporting the malware is robust, featuring nine distinct commands. These capabilities include altering the clipboard, sending HTTP requests, loading web pages, and executing JavaScript. However, researchers primarily observed attackers utilizing two commands: one to download and execute new code, and another to send web requests. The additional module deployed, named "zhima," functions as a reverse proxy. This indicates that the primary objective of the attackers is not to directly compromise or control the vehicle's functions, but rather to exploit the infected cars' internet connections as part of a larger proxy network.
Analysis of the malware's naming conventions and infrastructure led researchers to attribute the campaign with high confidence to the MoYu Group, an entity previously linked to the BADBOX botnet. A thread within the second-stage loader, internally named `mosdk-host-loader`, pointed to malware previously found on TV set-top boxes associated with the same group. This connection was further corroborated by overlapping network infrastructure independently identified by a separate research team around the same timeframe. The administrative panel for the proxy service also includes a copyright notice and requires an invite code for account creation.
