A New Front in Cybercrime: Malware Targets Car Infotainment Systems
In a disturbing trend, researchers at Kaspersky have uncovered malware specifically designed for car head units, marking the first time this type of attack has been seen. The malicious code, linked to the notorious BadBox botnet, exploits vulnerabilities in software update systems to deliver stealthy Android applications that serve as droppers, loaders, clickers, and reverse-proxy loaders.
The malware was discovered on an aftermarket infotainment system made by Chinese company DoFun, which is widely used in China and other Asia-Pacific countries. The attackers compromised the update distribution channel to install malicious software on vehicle head units, potentially leaving millions of drivers vulnerable to cyber threats while on the road.
Kaspersky researchers believe that the malware is the work of the MoYu Group, one of several entities linked to the development and operation of the BadBox botnet. This group has been responsible for hacking Android devices for fraud and other illicit activities since at least 2023, with Google filing a lawsuit against them last year over their involvement in the BadBox 2.0 botnet, which had ensnared over 10 million Android devices.
The use of car infotainment systems as a target for malware delivery is a concerning development, as it demonstrates that cybercriminals are expanding their scope and adapting to new technologies. The fact that these systems often rely on outdated software and lack robust security measures makes them an attractive target for attackers.
The malicious code discovered by Kaspersky supports nine commands, including those that enable its operators to display ads, conduct ad fraud, and download additional components. However, the researchers have observed only commands to download a reverse proxy module, suggesting that the main goal is to ensnare devices in a proxy botnet.
This development highlights the need for car manufacturers and owners to take cybersecurity seriously when it comes to their infotainment systems. Regular software updates and security patches can help prevent such attacks, but users must also be cautious about downloading apps from untrusted sources and avoid engaging with suspicious pop-ups or ads while driving.
Ultimately, this trend serves as a reminder that the boundaries between physical and digital worlds are becoming increasingly blurred, and cyber threats can have real-world consequences. As we continue to rely on technology in our daily lives, it’s essential to prioritize cybersecurity measures to protect ourselves and our loved ones from these emerging risks.
Source: SecurityWeek — 2026-08-25