Malware turns Android car head units into a proxy botnet that hides attacks behind trusted home IPs

The scary version of this story is that attackers can take over your car. That is not what happened. When Kaspersky published its analysis on August 21, the malware it found on Android car head units went out of its way to leave the vehicle alone. The value was never the car. It was the car's internet connection.

This is the third class of cheap connected hardware we have watched get pulled into the same business: turning someone else's device into a trusted home IP address that attackers rent to hide their traffic. The headline says automotive. The consequence lands on anyone running an internet-facing server.

What Kaspersky actually found

The malware is a multi-stage dropper Kaspersky named JarService. It installs like an ordinary Android app but ships with no user interface at all, which is what caught the researchers' attention. Kaspersky attributes it with high confidence to the MoYu Group, an actor already tied to the BADBOX botnet.

According to Kaspersky, it spread through the built-in update mechanism of DoFun head unit firmware: a legitimate system app called TWCore (package com.tw.core), which handles analytics and software updates, was abused to pull a rogue package. Update instructions arrive over an MQTT message broker on a cardoor[.]cn subdomain, and an installNotExists flag lets the payload install silently even when a check would normally stop it.

The final stage pairs click fraud with a reverse-proxy module named zhima, which Nokia Deepfield reported independently. Kaspersky documented seven payload versions, 3.57 through 3.68, each checking in with its command server roughly every 90 minutes. The nine supported commands cover code execution, HTTP requests, and basic device reconnaissance such as model, screen resolution, Wi-Fi network names, and MAC addresses. According to The Hacker News and Security Affairs, operators mostly used two of them: run code, and send web requests. Kaspersky says DoFun confirmed it resolved the distribution problem after being notified.

Kaspersky calls this the first documented case of malware with an infection chain built specifically for a car head unit. That is the genuinely new part. Everything else is a familiar operation wearing a new device.

The car is a red herring. The product is a trusted home IP.

A residential proxy network sells one thing: the ability to send traffic that looks like it came from a normal person's home broadband. To the website on the receiving end, a request routed through an infected head unit arrives from a residential ISP in an ordinary country, not a datacenter, not a flagged hosting range. That is the entire point. The car does the driving; the botnet does the laundering.

We have written this same story with different hardware. Millions of hacked TV boxes did it first, and we covered how that defeats IP-reputation blocking during account takeover. The FBI seized the NetNut proxy network, and yet its compromised devices stayed infected and useful. Exposed Linux servers get rented out the same way through fake installers. The device changes. The economics do not.

Why your blocklists and geo rules cannot see it

Most perimeter filtering rests on an assumption that is now wrong: that hostile traffic comes from datacenter address space or obviously foreign networks. IP reputation feeds, ASN blocks, and geo-fencing all encode that assumption. A request from an infected head unit breaks it, because it genuinely originates from a residential ISP in a plausible location.

So the abuse that rides these proxies sails straight through. Credential stuffing looks like scattered home users trying to log in. Scraping looks like organic browsing. Fraudulent checkout attempts look local. The moment your control is "is this IP known-bad or from the wrong country," a residential proxy network is built to win that argument. This is the exposure the automotive framing buries, and it is the one that touches your servers.

Stop trusting the IP. Watch the behavior.

The fix is to stop treating a clean-looking source address as evidence of a clean session. Move detection to behavior, where a proxied attack still stands out:

• Rate-limit per account and per session, not per IP. A residential proxy pool spreads one campaign across thousands of addresses, so per-IP limits never trip. Per-account velocity does.
• Alert on one home IP touching many accounts, or on a single account authenticating from many unrelated residential networks in a short window. Both are session patterns no real household produces.
• Flag mismatches between the network and the behavior: a residential ASN generating machine-speed request cadence, headless client fingerprints, or login attempts with no human timing.
• Score the login, not the address. Impossible travel, device-fingerprint churn, and failed-then-successful stuffing patterns survive the proxy; the IP reputation does not.

If you operate a fleet of embedded Android devices yourself, there is a second lesson here. The infection rode a legitimate update channel, so the endpoints those devices reach for firmware are worth knowing, restricting, and monitoring. An update client that can silently install an unexpected package is a supply-chain risk whether it lives on a phone, a kiosk, or a dashboard.

BADBOX is not finished

Takedowns have hit this operation and it keeps running. Kaspersky's own conclusion is that actors linked to BADBOX are still infecting devices worldwide and actively moving onto new platforms. Head units are simply the latest platform with an internet connection, weak scrutiny, and an update mechanism someone can abuse. The next device class is predictable, so the durable defense is not another blocklist. It is a detection stack that stops assuming a home IP means a home user.