KASPERSKY researchers reported a new form of malware targeting Android-based car head units, found in June 2026. The malware exploits the car's official update system to install proxy software, linking affected vehicles to the BADBOX botnet. This marks the first documented instance of malware on car head units, which are essentially Android devices.
The malware executes a multi-stage infection process, beginning with a legitimate app (TWCore) that installs a dropper, which then loads further harmful components acting as a proxy. The campaign is traced back to MoYu Group, connecting it to previously documented cybercriminal activities. As cars incorporate more digital technologies, they face increased security risks similar to traditional computing devices.