In June 2026, researchers discovered Android malware infecting automotive head units via built-in firmware updaters — the first documented case of its kind. The multi-stage downloader, attributed to the Mo Yu Group (linked to the BADBOX botnet), targets Do Fun head units through the legitimate TWCore system app. TWCore receives update commands via an MQTT broker at cardoor.cn, using an "installNotExists" flag to silently install new APKs.

The malware enables ad fraud and recruits devices into a proxy botnet. Kaspersky detects it as HEUR:Trojan-Dropper. AndroidOS.

Agent.vu, HEUR:Trojan-Downloader. AndroidOS. Agent.ov, HEUR:Trojan-Proxy.

AndroidOS. Zhima.*, and HEUR:Trojan. AndroidOS.

Vo1d.*. Head units, which often include SIM slots and internet access, are vulnerable due to weak firmware update validation. The vendor was notified and reportedly fixed the issues.

This highlights risks in Android-based automotive systems where supply-chain update mechanisms can be abused.