August 2026: Android Head Unit OTA Malware Exploits Built-In Automotive Update Channels

Cybersecurity researchers uncovered a novel malware campaign exploiting built-in software update pathways (TWCore app via MQTT brokers) in Android-based vehicle head units. This marks the first documented case of malware specifically leveraging an automotive-specific infection route to turn infotainment units into proxy botnets and ad-fraud targets. The exposure highlights critical vulnerabilities in Over-The-Air (OTA) maintenance frameworks directly affecting supply chain security.