HACKERS INFECT ANDROID CAR HEAD UNITS WITH PROXY BOTNET MALWARE

Summary from the TLDR InfoSec newsletter

The MoYu threat group has compromised DoFun-branded Android automotive head units by utilizing a rogue APK to deploy the "JarService" botnet malware. Delivered through the legitimate TWCore system app, the malware pulls instructions from an MQTT broker to convert infected vehicles into remote SOCKS5 proxy nodes and click-fraud clients. While researchers found no evidence of interference with physical vehicle controls, affected owners should actively monitor their network traffic for unauthorized communication with the cardoor[.]cn command domain.