The campaign turns connected infotainment systems into instruments for advertising fraud and proxy networks without requiring drivers to install suspicious applications.
GLOBAL.— Cybersecurity researchers have identified what they describe as the first documented malware campaign with an infection chain specifically designed for Android-based vehicle head units. Kaspersky discovered the threat while monitoring Android activity and found that it reached devices through their built-in firmware update system. The malicious application operated without a visible interface, allowing it to remain unnoticed.
The attack affected DoFun head units, which combine multimedia functions with limited control over certain vehicle features. A legitimate system application responsible for analytics and software updates was manipulated to install a multistage downloader. The manufacturer was notified and later reported that it had corrected the security weaknesses enabling the distribution.
Once active, the malware collected technical information including the device model, screen resolution, connected Wi-Fi network name and hardware address. It could generate fraudulent advertising interactions and convert the vehicle’s internet connection into part of a residential proxy botnet. Criminal operators could then route external traffic through the compromised unit, making malicious activity appear to originate from the driver’s connection.
Kaspersky attributed the campaign with high confidence to the MoYu Group, an actor associated with the BADBOX malware network. Owners of Android-based head units should obtain firmware only from verified manufacturers, install legitimate security updates and investigate unexplained data consumption or network activity. As vehicles become connected computers, cybersecurity failures can place an invisible passenger inside the dashboard long before the driver recognizes the danger.
Phoenix24 — Periodismo independiente para un mundo en transformación.
Phoenix24 — Independent journalism for a changing world.