MoYu Malware Turns Android Car Head Units into Proxy-Botnet ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/android-head-unit-malware/121106
• Blog Title: MoYu Malware Turns Android Car Head Units into Proxy-Botnet Nodes
• Suggested Section: Mobile Pentesting > Android Applications Pentesting, extending Insecure In-App Update RCE and Manual DeObfuscation; optionally cross-reference Basic Forensic Methodology > Android Malware Post-Exploitation

🎯 Content Summary

Overview and impact: Kaspersky discovered a multi-stage Android malware campaign in June 2026 targeting DoFun automotive head units. The UI-less initial payload, JarService, was installed through TWCore (com.tw.core), a legitimate preinstalled system application responsible for analytics and software updates. The chain ultimately provides ad-fraud and clicker functionality, arbitrary JavaScript execution in WebView, remotely configurable HTTP operations, dynamic ...

🔧 Technical Details

Abusing trusted update channels to install new applications: A preinstalled updater becomes a malware-delivery primitive when its remote instructions can request installation of APKs absent from the original device image. In this case, MQTT update objects include installNotExists; setting it to true bypasses the check that the package is already installed. The updater downloads the APK to <external cache>/push/apk/ and installs it without normal user discovery. This pattern should be hunted by correlating installer identities, update messages, cache artifacts, and newly introduced package names. The technique does not by itself prove that downloaded applications inherit the updater's privileges.

Layered XOR-encrypted Android payloads: Malware can embed serialized metadata and executable code as encrypted blocks inside an APK. A single-byte XOR key may change according to a predictable linear se...

🤖 Agent Actions

Updated:

src/mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md

Added concise coverage of:

• Trusted updater abuse to install previously absent APKs.
• Installer provenance and updater-cache forensic commands.
• Correct privilege-context interpretation.
• Layered XOR/DEX recovery and predictable payload-version enumeration.
• Configuration-driven reflective module loading and attacker-supplied hash limitations.
• Numbered Securelist and official Android references.

Validation passed: clean diff, structural checks, reference URLs HTTP 200, and no forbidden sources. Full mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/android-head-unit-malware/121106

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting, extending Insecure In-App Update RCE and Manual DeObfuscation; optionally cross-reference Basic Forensic Methodology > Android Malware Post-Exploitation".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0