KASPERSKY researchers have discovered the first malware specifically designed to infect Android‑based car head units, linking the compromised infotainment systems to the notorious BADBOX botnet according to their analysis. The discovery marks the first time that automotive infotainment has been seen as a vehicle for botnet recruitment. Analysts warn that the trend could inspire similar attacks targeting other embedded systems in modern vehicles.
The infection begins with a legitimate updater named TWCore, which runs with elevated privileges and silently installs a dropper called JarService as reported by SecurityAffairs. JarService then downloads additional modules that turn the head unit into a proxy node for the BADBOX infrastructure. No CVE identifiers have been assigned to this campaign because the abuse relies on legitimate update mechanisms rather than a software vulnerability. Researchers note that the abuse of trusted update channels bypasses many signature‑based defenses that rely on file reputation.
Once installed, the malware can read and modify clipboard data, trigger browser actions and fetch further payloads from command‑and‑control servers per SecurityOnline. These capabilities allow attackers to manipulate what the driver sees, inject fraudulent pages and maintain a persistent foothold inside the vehicle’s network. The multi‑stage design means each component only performs a limited function, making detection harder for traditional antivirus tools. Because the malicious modules are downloaded at runtime, static analysis of the initial package often shows nothing suspicious.
Kaspersky attributes the campaign to the MoYu Group, a threat actor previously observed in mobile‑focused fraud schemes. By tying the infected head units to BADBOX, the group expands the botnet’s reach into automotive environments, a first for the malware family. The appearance of this toolkit highlights how expanding digital features in cars creates new attack surfaces that mirror those found in smartphones and tablets. This shift highlights the need for threat models that treat infotainment as a potential pivot point rather than a isolated entertainment system.
Owners and fleet managers should verify that head‑unit firmware updates come only from official manufacturer channels and block any unsigned packages. Network segmentation can isolate the infotainment system from critical vehicle controls, limiting the impact of a compromised proxy. Security teams are advised to monitor outbound connections for patterns consistent with the BADBOX proxy, such as periodic beacons to known malicious IP ranges. Additionally, disabling developer mode and restricting ADB access on the head unit reduces the attack surface available to adversaries.
Sharing indicators of compromise with information‑sharing centres helps improve detection across the automotive supply chain. Finally, working with OEMs to enforce application allowlisting on head‑unit platforms can prevent the initial dropper from executing. Collaboration between cybersecurity vendors and car manufacturers is essential to develop timely patches and share threat intelligence.