Researchers at Kaspersky have come across what appears to be the first malware specifically designed for car head units, and have found links to the notorious BadBox botnet.
The malware was discovered on an Android-powered aftermarket infotainment system made by Chinese company DoFun, which is widely used in China and other APAC countries.
Threat actors exploited a vulnerability in a system designed to handle software updates, enabling them to deliver malware to vehicle head units, Kaspersky explained. The vendor said it addressed the weakness after being notified.
The attackers compromised the update distribution channel to deliver stealthy malicious Android applications that served as droppers, loaders, clickers, and reverse-proxy loaders.
The malware supports nine commands, including ones that enable its operators to display ads, conduct ad fraud (via the clicker component), and download additional components.
However, Kaspersky researchers have observed only commands to download a reverse proxy module, suggesting that the main goal is to ensnare devices in a proxy botnet.
Further analysis led the security firm to strongly believe that the malware is the work of the MoYu Group, one of several entities previously linked to the development and operation of the BadBox botnet.
BadBox has been around since at least 2023, enabling its operators to use hacked Android devices for fraud and other illegal schemes.
Law enforcement has attempted to disrupt it, but the threat has grown exponentially. Google last year filed a lawsuit against the operators of BadBox 2.0, warning that the botnet had ensnared more than 10 million Android devices, mainly TV boxes.
BadBox malware is often pre-installed on budget devices, but attacks targeting vehicle infotainment systems show that its operators are expanding their delivery methods and targets.
Related: Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
Related: Rust Supply Chain Attack Linked to North Korean Hackers
Related: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
