Android Auto trojan turns 30 million car radios into botnet
Kaspersky discovers first Android Auto trojan targeting Chinese DoFun's car radios.
1World's first Android Auto trojan
Kaspersky researchers identified new malware targeting connected car radios by Chinese manufacturer DoFun. The trojan converts infected devices into a botnet controlled by cybercriminals. The breach occurs through an automatic update mechanism requiring no user interaction. DoFun provides firmware and cloud services for head units used in 30 million vehicles globally.
2Infection method
The pre-installed TWCore app retrieves updates from a server in China. While normally used for software updates, the 'installNotExists' parameter allows app installations without user approval. Attackers exploit this to load a hidden module called JarService. This module contains an encrypted payload for the next attack stage and connects to a command server.
3Botnet operations
JarService downloads a second program that collects device ID and software version, then installs a third module named zhima. Zhima connects to the command server every 90 minutes, executing up to nine different commands. The most common enables arbitrary code execution. The botnet then links to proxy platforms like PXYEDGE and ProxyForU.
4Click fraud scheme
The botnet primarily generates revenue through ad click fraud. A separate module displays ads and creates fake clicks, generating illicit income. For drivers, the noticeable effects include reduced device performance and slower internet speeds as processing power is diverted for botnet activities.
5MoYu group connection
Kaspersky attributes the attack with high confidence to the MoYu group. Evidence includes shared infrastructure with Badbox cybercrime platform and malware previously detected in TV boxes. Nokia Deepfield Emergency Response independently confirmed this link. The Badbox 2.0 botnet had infected over a million devices across 222 countries in 2025.
6Google's countermeasures
On July 3, 2026, Google announced dismantling the NetNut (Popa) proxy network that covertly used about two million home devices. This marked Google's third such operation within a year, following actions against Badbox 2.0 and IPIDEA networks. The company closely monitors the rise of illicit proxy networks.
7Industry-wide vulnerability
DoFun head units run full Android systems supporting app installations, creating a broad attack surface. Other cheap Android-based devices in the industry carry similar risks. In 2025, the FBI warned about widespread infections in uncertified Android devices, including car multimedia systems and smart TVs.
8Why it matters
This case demonstrates serious consequences of security flaws in connected car systems. The potential compromise of radios in 30 million vehicles creates a new vector for large-scale cyberattacks. Automotive manufacturers need stricter update controls, while consumers require awareness. Security vulnerabilities in cheap Android devices have become a global threat.
Original article: TalkAndroid — Android Auto trojanu 30 milyon araç radyosunu botnete dönüştürdü