Android car screens hijacked via firmware update with TWCore, JarService & zhima malware. #CarInfotainment #AndroidSecurity #AutomotiveCybersecurity #InfotainmentMalware #MoYuGroup #FirmwareSecurity https://thedailytechfeed.com/android-car-screens-hijacked-via-update-system-by-moyu-group/
August 24, 2026 at 8:34 AM
Android car screens hijacked via firmware update with TWCore, JarService & zhima malware. #CarInfotainment #AndroidSecurity #AutomotiveCybersecurity #InfotainmentMalware #MoYuGroup #FirmwareSecurity https://thedailytechfeed.com/android-car-screens-hijacked-via-update-system-by-moyu-group/
Kaspersky exposed Android head unit malware turned into a botnet. Discover how this Android head unit malware botnet infects smart cars.
#AndroidMalware #CarSecurity #MoYuGroup #BADBOX #CyberSecurity
#AndroidMalware #CarSecurity #MoYuGroup #BADBOX #CyberSecurity
Android Head Unit Malware Recruits Vehicles into Botnet
At a glance Factor Details Malware Family JarService dropper and zhima proxy module Threat Actor MoYu Group (High confidence attribution; linked to BADBOX botnet) Targets Android-based automotive head units (DoFun firmware) Delivery Vector Built-in system updater (TWCore) via MQTT command broker Key Capabilities Silent app installation, ad click fraud, residential proxy routing Source
securityonline.info
August 21, 2026 at 9:12 AM
Kaspersky exposed Android head unit malware turned into a botnet. Discover how this Android head unit malware botnet infects smart cars.
#AndroidMalware #CarSecurity #MoYuGroup #BADBOX #CyberSecurity
#AndroidMalware #CarSecurity #MoYuGroup #BADBOX #CyberSecurity
New Android malware is abusing the TWCore updater on automotive head units, ending in ad fraud and a proxy botnet via zhima. Kaspersky links the campaign to MoYu Group with high confidence. #TWCore #BADBOX #China
The invisible passenger in your car
Researchers uncovered a new Android malware campaign targeting Android-based automotive head unit firmware through the legitimate TWCore updater, making this the first documented infection chain of its kind on a car head unit. The multi-stage payload ends in a clicker and the zhima reverse proxy module, and Kaspersky attributes the activity with high confidence to the MoYu Group, an actor linked to BADBOX. #TWCore #JarService #zhima #MoYuGroup #BADBOX #DoFun
www.hendryadrian.com
August 21, 2026 at 10:15 AM