Critical Vulnerabilities in Harman Kardon Infotainment Systems Expose Android Car Screens

Key Takeaways

• A new Android malware campaign, attributed to the MoYu Group, has been discovered targeting in-car infotainment systems.
• The malware leverages a legitimate software update mechanism in Android-based head units, specifically the TWCore application, to install malicious payloads.
• Instead of direct vehicle control, the malware transforms infected car screens into participants in an ad fraud scheme and a proxy botnet.
• The vendor of the affected firmware has reportedly issued a fix for the identified security vulnerabilities.

Malware Campaign Hijacks Android Car Infotainment Systems via Updates

A novel Android malware operation has surfaced, turning car infotainment screens into an unexpected vector for cybercrime. This sophisticated campaign bypasses typical user interaction by exploiting the inherent software update pathways within Android-based head units, rather than relying on social engineering tactics like deceptive app installations.

The multi-stage malware acts as a downloader, facilitating ad fraud and integrating affected devices into a proxy botnet. It specifically targets connected vehicle screens, which manage functions ranging from music and navigation to certain vehicle controls, by exploiting their internet connectivity—the same access point used for routine software updates. This strategy transforms a seemingly trusted maintenance feature into a critical entry point for a broader criminal enterprise.

Analysts at Securelist detected this malware while tracking Android threats in June 2026, subsequently reconstructing the entire infection chain. Researchers have highlighted this as the first documented instance of head-unit malware utilizing a device-specific infection route. They have linked the operation to the MoYu Group, an entity previously associated with the BADBOX malware.

Securelist said in a report, which was shared with Cyber Security News (CSN), that the design of the affected firmware enabled this distribution method. The vendor has since indicated that the security issues have been addressed. This discovery broadens the scope of concern beyond traditional Android devices like phones and televisions, underscoring the growing risks associated with connected screens becoming a standard feature in modern vehicles.

Exploiting the Update Mechanism

The core of this attack revolves around TWCore, a legitimate system application designed for collecting analytics and managing software updates on head units. Threat actors leveraged an MQTT broker, hosted on the cardoor[.]cn infrastructure, to transmit details of malicious APK files for download. A specific setting within TWCore, named installNotExists, could be manipulated to instruct the application to install software not originally present on the device, thereby creating an opening for the malicious package.

Telemetry data revealed that the unknown malware was placed into TWCore’s update cache and subsequently installed by the com.tw.core package. The initial component, JarService, operates without a user interface. Its primary function is to decrypt embedded data and launch the subsequent payload, ensuring the infection remains hidden from the driver.

Following this, a second-stage loader communicates device information to an attacker-controlled server and retrieves a link for the next component. The third stage maintains regular check-ins, gathering details such as the device model, display resolution, Wi-Fi network name, and MAC address, then receiving updated configuration data or commands.

This attack chain significantly differs from typical phone scams, which often commence with phishing texts, malicious advertisements, or deceptive app store lures. Prior instances of BADBOX Android device infections have demonstrated how compromised firmware can expose connected devices without immediate user awareness. This new case extends that vulnerability directly into the automotive environment.

From Screen to Proxy Network

The final payload of the malware is capable of displaying advertisements, generating fraudulent clicks, downloading additional code, and opening web content discreetly in the background. Researchers observed that the operators issued commands to fetch a reverse-proxy module named “zhima.” This module enables an infected head unit to relay network traffic for external parties, effectively transforming a car screen into an active node within a clandestine network.

Attribution of this campaign to the MoYu Group is based on consistent malware naming conventions, shared infrastructure, and overlaps with previously documented activities linked to the group. The researchers also identified connections between this operation and a malicious TV-box application, noting common infrastructure with campaigns associated with BADBOX. This pattern can be compared to the Vo1d Android TV botnet, which similarly illustrated the expansive scale that interconnected Android devices can offer to attackers.

While the report does not indicate that the malware directly controls safety-critical vehicle systems like steering or braking, any compromise of an infotainment device can introduce significant privacy, connectivity, and trust issues. The broader risks within the automotive sector are evident from past incidents, such as a Nissan Leaf infotainment flaw, where a separate vulnerability could potentially bridge an in-car system to vehicle functions.

What You Should Do

• Only Install Verified Updates: Always ensure that software updates for your vehicle’s head unit are sourced exclusively from verified manufacturer or authorized dealer channels. Avoid connecting unknown software or USB media.
• Inquire About Security Fixes: Contact your vehicle manufacturer or dealership to confirm whether your head unit has received the necessary security patches for this vulnerability.
• Manufacturers: Implement Strict Controls: Vehicle manufacturers should enforce strict controls, including requiring signed packages for all update services and validating every remote instruction. Establish a clear process for revoking malicious updates.
• Monitor for Anomalies: Be vigilant for any unexplained app installations, unusual network prompts, or abnormal system behavior on your infotainment screen. Report any suspicious activity to the manufacturer immediately.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.