# Android Auto trojan turns 30 million car radios into botnet Kaspersky discovers first Android Auto trojan targeting Chinese DoFun's car radios. - **Source:** [TalkAndroid](https://brifing.si/source/ab08cf35-9595-489a-9848-b3b3b67ca5ca) - **Published:** 2026-08-29 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/45961449-2aec-4c72-b3a9-3a6666b07e91 ## World's first Android Auto trojan Kaspersky researchers identified new malware targeting connected car radios by Chinese manufacturer DoFun. The trojan converts infected devices into a botnet controlled by cybercriminals. The breach occurs through an automatic update mechanism requiring no user interaction. DoFun provides firmware and cloud services for head units used in 30 million vehicles globally. ## Infection method The pre-installed TWCore app retrieves updates from a server in China. While normally used for software updates, the 'installNotExists' parameter allows app installations without user approval. Attackers exploit this to load a hidden module called JarService. This module contains an encrypted payload for the next attack stage and connects to a command server. ## Botnet operations JarService downloads a second program that collects device ID and software version, then installs a third module named zhima. Zhima connects to the command server every 90 minutes, executing up to nine different commands. The most common enables arbitrary code execution. The botnet then links to proxy platforms like PXYEDGE and ProxyForU. ## Click fraud scheme The botnet primarily generates revenue through ad click fraud. A separate module displays ads and creates fake clicks, generating illicit income. For drivers, the noticeable effects include reduced device performance and slower internet speeds as processing power is diverted for botnet activities. ## MoYu group connection Kaspersky attributes the attack with high confidence to the MoYu group. Evidence includes shared infrastructure with Badbox cybercrime platform and malware previously detected in TV boxes. Nokia Deepfield Emergency Response independently confirmed this link. The Badbox 2.0 botnet had infected over a million devices across 222 countries in 2025. ## Google's countermeasures On July 3, 2026, Google announced dismantling the NetNut (Popa) proxy network that covertly used about two million home devices. This marked Google's third such operation within a year, following actions against Badbox 2.0 and IPIDEA networks. The company closely monitors the rise of illicit proxy networks. ## Industry-wide vulnerability DoFun head units run full Android systems supporting app installations, creating a broad attack surface. Other cheap Android-based devices in the industry carry similar risks. In 2025, the FBI warned about widespread infections in uncertified Android devices, including car multimedia systems and smart TVs. ## Why it matters This case demonstrates serious consequences of security flaws in connected car systems. The potential compromise of radios in 30 million vehicles creates a new vector for large-scale cyberattacks. Automotive manufacturers need stricter update controls, while consumers require awareness. Security vulnerabilities in cheap Android devices have become a global threat. ## Sources covering this story - https://www.talkandroid.com/530368-the-worlds-first-android-auto-trojan-turns-millions-of-car-radios-into-a-global-botnetexperts-sound-the-alarm-87321/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._