# New Malware Targets Car Head Units, Expands Notorious Botnet

*Published August 26, 2026*
*Source: [https://www.securityweek.com/first-malware-built-specifically-for-car-head-units-fuels-botnet/](https://www.securityweek.com/first-malware-built-specifically-for-car-head-units-fuels-botnet/)*

## Executive Summary

Kaspersky researchers have discovered malware targeting car head units, linked to the BadBox botnet. This development broadens the attack surface for cybercriminals and highlights the evolving tactics of botnet operators.

## Article

Researchers at Kaspersky have identified a groundbreaking form of malware specifically designed for car head units, marking a significant shift in cyber threats targeting vehicles. This malware has been linked to the BadBox botnet, a well-known network used for various illegal activities. It was found on an Android-based infotainment system produced by the Chinese company DoFun, popular in China and other regions in the Asia-Pacific. The attackers exploited a vulnerability within the system's software update mechanism, allowing them to distribute malicious applications to the vehicle head units. Kaspersky reports that these applications functioned as droppers, loaders, clickers, and reverse-proxy loaders, supporting nine different commands. While these applications are capable of ad fraud and other malicious activities, current observations suggest their primary function is to download a reverse proxy module, aiming to incorporate devices into a proxy botnet. Kaspersky's analysis strongly suggests that the malware is linked to the MoYu Group, known for its involvement with the BadBox botnet. Despite efforts by law enforcement and legal actions from companies like Google, the BadBox botnet has continued to grow, having compromised over 10 million Android devices, including TV boxes. The evolution of BadBox to include vehicle infotainment systems indicates a broadening scope of attack vectors, raising significant concerns for both consumers and cybersecurity professionals.