MoYu Group campaign expands across multiple victims
Campaign
Summary
Hide ▲
Show ▼
The BADBOX infection campaign is still active, with MoYu Group-linked actors using abused update channels to spread malware to devices worldwide and support ad fraud plus a proxy botnet. The operation turns legitimate firmware update paths on DoFun Android head units into a delivery channel. The result is continued device compromise despite takedown efforts.
Related Happenings
DoFun Android head unit malware spread through built-in updaters
Malware Activity
H score29
First: 21.08.2026 18:41
Last: 21.08.2026 18:41
Sources 1
How related:
The malware spread through the built-in updaters of Android-based automotive head unit firmware,
About this happening:
A new Android head-unit malware spread through built-in updaters on DoFun firmware, enabling ad fraud, unwanted ads, and proxy botnet activity on infected devi...
DoFun Android head unit malware spread through built-in updaters
Malware ActivityHow related: The malware spread through the built-in updaters of Android-based automotive head unit firmware,
About this happening: A new Android head-unit malware spread through built-in updaters on DoFun firmware, enabling ad fraud, unwanted ads, and proxy botnet activity on infected devi...
Vo1d botnet campaign targeting unofficial Android-based TV boxes
Campaign
H score88
First: 18.06.2026 20:37
Last: 18.06.2026 20:37
Sources 1
About this happening:
NetNut used the Popa botnet and deceptive SDKs on off-brand Android-based smart TVs, streaming media boxes, and unofficial apps to turn home connections into residen...
Vo1d botnet campaign targeting unofficial Android-based TV boxes
CampaignAbout this happening: NetNut used the Popa botnet and deceptive SDKs on off-brand Android-based smart TVs, streaming media boxes, and unofficial apps to turn home connections into residen...
Latest development: 03.07.2026 12:35
Google disabled all Google accounts used by NetNut for malware command-and-control, updated Google Play Protect to warn Android users, and disabled apps containing the compromised SDKs. The FBI’s seizure banner appeared on netnut.com while netnut.io briefly remained accessible, and Google said the coordinated actions caused significant degradation to NetNut’s proxy network and business operations.
Keenadu Android backdoor embedded in firmware and app delivery paths
Malware Activity
H score27
First: 17.02.2026 16:05
Last: 17.02.2026 16:05
Sources 1
About this happening:
The Keenadu Android backdoor was found embedded in firmware from multiple device brands, putting infected devices and their installed apps at risk of full compromise. The...
Keenadu Android backdoor embedded in firmware and app delivery paths
Malware ActivityAbout this happening: The Keenadu Android backdoor was found embedded in firmware from multiple device brands, putting infected devices and their installed apps at risk of full compromise. The...
Timeline
-
21.08.2026 18:41 2 articles · 3h ago
Kaspersky identifies Android malware on DoFun head unit firmware
Initial DisclosureKaspersky identifies a new Android malware family targeting DoFun vehicle head unit firmware, first discovered in June 2026, and attributes the activity with high confidence to MoYu Group and the broader BADBOX operation. The malware abuses built-in updater functionality in Android-based automotive head units, uses the TWCore update path and the JarService dropper to stage additional payloads, and is designed to support ad fraud and proxy-botnet activity.
Show sources
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet — thehackernews.com — 21.08.2026 18:41
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet — thehackernews.com — 21.08.2026 18:41