The invisible passenger in your car

A new multi-stage Android malware has been discovered targeting automotive head units via compromised firmware update mechanisms. The malware, distributed through the legitimate TWCore app's update function, operates in three stages: an initial dropper (JarService), a loader, and a final stage that performs ad fraud and establishes a reverse proxy botnet. The infection chain leverages MQTT-based commands and downloads malicious payloads from attacker-controlled servers. This campaign is attributed to the MoYu Group, a threat actor associated with the BADBOX botnet, based on code similarities, infrastructure overlap, and naming patterns observed in other compromised devices such as TV set-top boxes.

AI-extracted · verify before operational use