Warning about cheap Chinese Android car stereos embedded with Botnet malware
01 Oct 2026
Malware on Android devices is not limited to just smartphones or tablets, as a recent campaign targeting car audio systems, or Car Head Units using the Android operating system has been discovered. Some cheap models have been found to contain components that allow attackers to remotely install additional malware.
According to a report from Help Net Security, security researchers from Kaspersky have discovered this campaign, which turns the victim's device into part of a Botnet for further attacks on systems or other infrastructure.
Although car audio systems may not seem like a high-value target compared to other Android devices, these devices often support internet connectivity via SIM cards to use features such as navigation systems and software updates, making them potential tools for expanding malware networks.
Moreover, such devices may operate inside the car for long periods without the user noticing any abnormalities, allowing malware to remain on the device for an extended period.
It is suspected to be a Supply Chain Attack by the MoYu group.
Kaspersky researchers have high confidence that this incident is related to a Supply Chain Attack, linked to the hacker group MoYu Group, which has been identified as behind the spread of the BADBOX Botnet through malware embedded in the firmware of cheap devices.
In the latest case, the affected devices are audio systems using DoFun firmware, with a System App named TWCore installed from the system. This application is responsible for data analytics, as well as downloading and installing audio system software updates.
The critical point is that TWCore can receive commands from the domain cardoor[.]cn to determine whether to install certain application files on the device.
In these commands, there is a field named installNotExists, which can be set to True or False. If set to False, the system will allow the installation of applications that are not originally on the device.
This pathway could become a risk point if attackers can access the server and send commands to TWCore to download or install additional applications, potentially leading to malware installation without the user's knowledge.
Malware operates as a step before installing Payload.
The attack process begins by downloading a malware Loader named JarService, which acts as an intermediary to connect to the next Loader.
Then, the second Loader collects basic device information and sends it back to the control server before receiving a link to download the third Loader.
When the third Loader operates, it downloads the Payload, which is the main malware, and stores detailed device information, such as screen resolution, device model, connected Wi-Fi network, and MAC Address, while waiting for commands from the control server.
Commands that researchers found the malware supports include
return — retrieves data from the infected device to send back to the server
copy — copies data from the Clipboard
http — sends a Request to the server
web — opens a link through a Hidden Web Browser to execute JavaScript
loadlib — the function of this command is not yet identified
loadlib2 — downloads and executes additional code
loadlib3 — the function of this command is not yet identified
deeplink — opens a link through the device's web browser
traceroute — checks if it can reach a specified destination
However, from the research team's investigation, only the commands loadlib2 and http were actually used to download malware named zhima.
zhima is a type of Reverse Proxy Botnet malware, which can use the IP address of the infected device as part of the infrastructure for cybercrime.
DoFun has acknowledged and addressed the issue.
Kaspersky has reported the discovered issue to DoFun, and has received confirmation that the company has successfully closed the related vulnerabilities.
This case reflects that low-cost Android devices connected to the internet are not only at risk from applications installed by the user, but also from system software and firmware that come with the device, especially when the device can download and install software from remote servers.
Source: www.helpnetsecurity.com
Other related
Warlock, Ransomware, Malware, Microsoft SharePointWarlock Ransomware Breaches Organizations via SharePoint, Disabling Security Defenses for Up to 2 Hours
IT News, Safari, Apple, Adaptive Dark ModeSafari Tests Adaptive Dark Mode, a Feature That Automatically Converts Websites to Dark Mode
IT News, Microsoft Edge, PDF
