A car’s touchscreen looks harmless. It plays music, shows maps, and handles the climate controls. But researchers have now found malware that turns those screens into infrastructure for online crime. They traced the campaign to MoYu, a threat group that runs a proxy botnet built from hijacked consumer devices. This time the target was the Android head unit sitting in the middle of the dashboard.
The campaign counts as a first. Nobody had previously documented an infection chain designed specifically for a car head unit. The malware never touches steering, braking, or any driving function. Instead, it quietly sells access to the car’s internet connection.
Inside the DoFun supply chain compromise
The affected hardware comes from DoFun, a Chinese automotive software and hardware supplier owned by Shenzhen Driving Control Technology Co., Ltd. DoFun produces generic Android head units, which act as the command center for infotainment, navigation, and system settings. Those boards end up in many different vehicles, so one compromise reaches a wide pool of drivers.
In June, researchers noticed a rogue APK file arriving through TWCore, a legitimate DoFun system app. TWCore takes its instructions from an MQTT server hosted at cardoor[.]cn. Because the file came from a trusted system component, the head unit accepted it without complaint. That trust gave MoYu a clean path for spreading its proxy botnet.
How JarService takes over a head unit
The downloaded app, JarService, has no icon and no interface. Once it launches, it decrypts a second-stage loader and runs it. The loader then contacts a command-and-control server and pulls down another encrypted payload. Each layer hides the next, so a casual look at the device reveals almost nothing.
The final payload reports back regularly with details about its host. It sends the model, the display resolution, the Wi-Fi network name, and the MAC address. Operators use those details to sort infected units and pick targets.
The command set
The payload accepts nine commands:
- return pulls a stored value from Android’s SharedPreferences storage
- copy places stored or downloaded content on the clipboard
- http sends GET or POST requests and can save part of the response
- web opens a URL in a WebView and runs supplied JavaScript
- loadlib remained unfinished at the time of analysis
- loadlib2 downloads and executes arbitrary code or extra modules
- loadlib3 also remained unfinished
- deeplink opens a chosen resource in the browser
- traceroute pings hosts to check whether they respond
Two commands sat incomplete, which suggests the operators still plan to expand the toolkit. The second loader matters most. It lets attackers bolt on new capabilities long after the initial infection.
Why MoYu turns cars into proxy botnet nodes
In practice, the operators mainly pushed a reverse-proxy module named zhima. That module converts the head unit into a relay, so other people’s traffic exits through the car’s internet connection. Alongside the proxy work, the malware also generated fake web requests for click fraud.
Money drives the whole operation. Every device MoYu adds to the proxy botnet becomes a residential exit point that somebody else can rent by the hour.
What a residential proxy actually does
Criminals place a high value on ordinary home and mobile IP addresses. Fraud detection systems trust them, because they belong to real households rather than data centers. So traffic routed through a hijacked car reads as an ordinary person browsing from a suburban street.
That traffic can be almost anything. Credential stuffing, ticket scalping, ad fraud, and scam campaigns all perform better behind a clean residential address. Meanwhile the car owner carries the reputation risk, since their IP address is the one that lands in the logs.
A proxy botnet is not a privacy tool
Both a VPN and a proxy network route traffic through another machine, and the similarity stops there. A VPN provider runs its own infrastructure with consent, publishes a logging policy, and answers to a jurisdiction. The MoYu proxy botnet rents out equipment nobody agreed to lend.
The distinction matters for anyone shopping around for cheap privacy tools. Bargain proxy services often source their addresses from infected devices, so the low price comes with a hidden victim. A reputable VPN gives you a named operator, an audited policy, and somebody to contact when things go wrong.
What drivers can do about it
Kaspersky reported the findings to DoFun, and the company said it resolved the problem. Even so, aftermarket head units rarely receive long-term support. Plenty of units already on the road will never see another update.
A few habits reduce the exposure. Keep the unit connected to the internet only when you actually need maps or streaming. Avoid sideloading APKs from third-party stores. Before buying an aftermarket unit, check the vendor’s update history rather than the spec sheet.
Data usage gives the clearest warning. A head unit that suddenly burns through gigabytes has probably started working for someone else. A factory reset may not remove the MoYu proxy botnet malware either, because the loader arrives through a system app that survives the wipe.
Final Thoughts
Cars now sit beside routers, TV boxes, and cameras on the list of devices worth hijacking. MoYu found a proxy botnet opportunity in the dashboard, and the method worked because a trusted update app delivered the payload. Supply chain trust remains the soft spot in cheap connected hardware.
Drivers cannot audit firmware, so purchasing decisions carry more weight than technical skill here. Pick vendors with a visible update record, switch off connections you do not need, and treat odd data spikes as a signal. The car may drive perfectly well while its dashboard quietly works a second job.
