MoYu hijacks a legitimate DoFun app to turn Android head units into a proxy botnet

June 2026. August 22, 2026. Nine commands. An actor already tied to the BadBox botnet is now infecting DoFun-brand Android head units through the devices’ own update channel. Kaspersky researchers have documented the most precise infection chain yet published for this class of hardware, and the takeaway is one sentence: a car head unit is no longer a peripheral — it is a monetizable residential proxy node.

The malware — JarService — is not the novelty. The target is. According to Kaspersky, this is the first time an infection chain has been engineered specifically for a car head unit rather than a generic smartphone or Android box.

An infection chain that runs through the official channel

The entry point is not a pirated APK from a forum. It is TWCore, a legitimate system application from DoFun, the Chinese automotive software and hardware vendor owned by Shenzhen Driving Control Technology Co., Ltd.

In June, Kaspersky researchers observed an unknown APK being downloaded from that app. TWCore receives its instructions through an MQTT server hosted at cardoor[.]cn. It is this telemetry and update channel that serves as the vector for the malware download.

Once installed, JarService behaves like a discreet second stage: with no user interface, it decrypts and runs a loader that establishes contact with a command-and-control (C2) server and fetches another encrypted payload. That payload periodically reports the device model, screen resolution, Wi-Fi SSID, and MAC address, then waits for orders.

Nine commands, three uses

The malware implements nine commands that make its business model clear:

• return — reads a value from Android SharedPreferences storage;
• copy — copies stored or downloaded content to the clipboard;
• http — sends GET or POST requests and can save part of the response;
• web — opens a URL in a WebView and executes supplied JavaScript;
• loadlib / loadlib3 — not fully implemented at the time of the report;
• loadlib2 — downloads and executes arbitrary code or additional modules;
• deeplink — opens a resource in the browser;
• traceroute — checks host reachability via ICMP ping.

Three uses emerge. Click fraud (http, web, deeplink), traffic relay (copy, return, traceroute), and capability extension (loadlib2), which lets the operator drop arbitrary new modules later.

A proxy module named “zhima”

The module the operator loads first is called zhima. It is a reverse proxy that turns the head unit into a node in a residential proxy botnet. The device becomes a “clean” internet exit point — a legitimate residential IP — that the attacker resells to anonymize other operations, bypass geo-blocks, or commit ad fraud.

It is the same model as BadBox, the botnet of more than 190,000 low-cost Android devices documented since 2023 and targeted by German authorities in 2024 through domain sinkholing. Kaspersky attributes the new campaign to the same group, MoYu.

The important nuance: Kaspersky states the malware does not interfere with driving or with the vehicle’s critical systems. It lives in the infotainment stack, not on the CAN bus. The risk is not a remotely crashed car; it is an always-on connected device burning mobile data, heating its chassis, and relaying abuse online — without the owner knowing.

Why this matters now

Three reasons make this case a landmark for connected-device security.

First, trust in the official channel. The infection rides a legitimate system app, which makes the hijack nearly impossible for an end user to detect. There is no fake site to avoid, no APK to refuse. The trusted component is itself the vector.

Second, the absence of a clear fix. Kaspersky says it notified DoFun, which replied that it had resolved the problem. But BleepingComputer, which reports the story, said it had received no details on the initial compromise vector at publication time. “Resolved” without detail does not say whether the cardoor[.]cn channel is actually closed, or how already-infected devices get cleaned.

Third, a precedent that previews what comes next. Generic-brand Android head units are ubiquitous on the second-hand and aftermarket market, often with no organized security updates. A device that never receives patches is a prime target for this kind of exploitation, which needs no “classic” vulnerability — just a compromised supply channel.

BadBox, the precedent

The BadBox precedent makes the lineage obvious. Documented from 2023, that botnet exploited the supply chain of low-cost Android tablets and boxes shipped with a trojan preinstalled at the factory. In December 2024, Germany’s BSI coordinated a sinkholing that cut off communication for tens of thousands of infected devices on its soil. MoYu reuses the same playbook against a pricier, more connected, and longer-lived device: the head unit, which stays in service for years without ever receiving a patch.

How to detect a compromised unit

In the field, detection is pragmatic. An infected head unit burns mobile data or Wi-Fi even when parked, maintains outbound connections to unusual hosts, and can show abnormal infotainment latency. The signals to watch:

• Outbound connections to cardoor[.]cn or any unknown domain from the vehicle’s network;
• Abnormal data usage reported by the carrier, beyond navigation and streaming;
• Unexpected processes if the head unit exposes developer options or adb.

On a fleet, the most effective measure remains network isolation: a dedicated VLAN for in-vehicle equipment, with an allowlist of destinations, turns a compromised head unit into a contained incident rather than a gateway into the rest of the fleet.

The economics explain the persistence. Residential proxies command a premium because they look like real home connections: hard for anti-fraud systems to block, and useful for ad verification, price scraping, and large-scale account creation. A car head unit online around the clock on a mobile IP is a more stable proxy asset than most infected phones. That recurring revenue — not a one-off theft — is why MoYu invests in supply-chain persistence, and why a patch claim from the vendor does not by itself end the campaign: already-infected units keep relaying until they are reflashed or taken offline.

Verdict

If you run a fleet of vehicles with Android head units, treat every head unit as untrusted IoT: isolate its connectivity on a dedicated VLAN, block outbound flows to unusual destinations, and disable cellular or tethering when the vehicle does not need it. A head unit has no legitimate reason to contact cardoor[.]cn or an unknown C2 server.

If you own a DoFun or generic-brand head unit as an individual, the only realistic step is to monitor the device’s data usage and network traffic, and prefer a replacement from a brand that documents its patch cycle. DoFun’s “resolved” claim must be verified, not taken on faith.

The lesson goes beyond the head unit: a compromised official update channel neutralizes every end-user best practice. Security now lives at the vendor, not in the dashboard.

References

• Hackers infect Android car head units with proxy botnet malware — BleepingComputer, August 22, 2026
• Kaspersky — analysis of the MoYu campaign against DoFun head units, accessed August 23, 2026
• BadBox: the 190,000-device Android botnet — background, accessed August 23, 2026