A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud.
Kaspersky researchers analyzed the malware and attributed the operation to the MoYu group, a threat actor previously associated with the BadBox malware botnet.
The researchers note that this is the first documented case of a malware infection chain specifically created for the targeted car head unit.
MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd.
DoFun is an automotive software, cloud services, and hardware provider that sells generic Android-based head units, which act as the command center for a car's infotainment, navigation, and settings systems.
