MoYu Group Malware Infects DoFun Head Units via TWCore MQTT Updater
First documented malware campaign targeting automotive head-unit firmware used the device's own update mechanism. The MoYu Group delivered botnet components to DoFun units via a flag-controlled installer. Remediation occurred after disclosure, but equivalent patterns persist across vendors.
The infection began when TWCore processed MQTT messages containing APK URLs and an installNotExists flag set to true. This allowed silent installation of HEUR:Trojan-Dropper.AndroidOS.Agent.vu into the external cache directory, followed by additional stages delivering HEUR:Trojan-Proxy.AndroidOS.Zhima and HEUR:Trojan.AndroidOS.Vo1d components.
Kaspersky recorded the chain during June 2026 Android monitoring and linked the infrastructure to MoYu Group operations previously tied to BADBOX. The vendor confirmed remediation of the updater logic after notification, yet the design permitted arbitrary APK deployment on any unit with SIM connectivity.
Head units differ from phones because they lack banking targets yet possess persistent network access, making them efficient proxy nodes. This case exposes a supply-chain vector absent from standard Android threat models: manufacturer analytics apps that bypass Play Protect and user review.
Similar MQTT-based updaters remain in other aftermarket Android head units. Vehicle operators receive no visible indicators while their devices participate in botnet activity.
Kaspersky: At least five additional head-unit vendors ship equivalent MQTT updaters by December 2026.
Sources (2)
- [1]Primary Source(https://securelist.com/android-head-unit-malware/121106/)
- [2]Supporting Source(https://securelist.com/badbox-2-0/114614/)