Cybersecurity News

Android car systems abused by hackers to launch new malware that pulls devices into a hidden proxy network

August 25, 2026

Kaspersky discovered Android malware targeting DoFun car head units by hijacking the TWCore update app to install malicious APKs. The multi-stage attack deploys a dropper, loader, and reverse proxy tool, with the apparent goal of building a botnet from internet-connected vehicles. Kaspersky attributed the campaign to MoYu Group, previously linked to the BadBox botnet. DoFun has since patched the vulnerabilities.

• android
• malware
• botnet
• automotive security
• mobile security
• kaspersky

Even connected car head units are being targeted by hackers now — experts warn in-car systems are at risk of being hijacked into a botnet

August 24, 2026

Kaspersky has identified the first malware campaign built specifically to target Android-based car head units, linking it to the MoYu Group behind the BadBox botnet. Attackers hijacked a legitimate software update channel in DoFun-manufactured devices to silently deliver malware capable of ad fraud, displaying unwanted ads, and harvesting device data. The malware runs invisibly with no user-facing interface. DoFun says the issue has since been resolved on most affected devices.

• connected cars
• botnet
• android malware
• automotive security
• kaspersky
• badbox