A supply-chain attack against Android-based car head units is spreading malware through a legitimate DoFun update app, turning compromised devices into proxy botnet nodes and tools for ad fraud. Kaspersky linked the campaign to the MoYu group and identified JarService, which downloads additional payloads, reports device details, and supports commands used for monetization. #MoYu #DoFun #JarService #TWCore #BadBox #zhima
Keypoints
- The attack targets Android-based car head units through a supply-chain compromise.
- A legitimate DoFun app was used to deliver the JarService malware.
- JarService downloads a second-stage loader and communicates with a C2 server.
- The malware can turn infected devices into proxy botnet nodes and support ad fraud.
- Kaspersky attributed the operation to the MoYu group and said DoFun fixed the issue.