# Dropper

Published articles for Dropper.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Android Malware Delivered Through DoFun Car Head-Unit Updaters Builds a Proxy Botnet

DevFeed: [Android Malware Delivered Through DoFun Car Head-Unit Updaters Builds a Proxy Botnet](<https://devfeed.tech/articles/the-invisible-passenger-in-your-car-48823.md>)

Original publisher: [Read original article](<https://securelist.com/android-head-unit-malware/121106/>)

Author: Dmitry Kalinin

Published: 2026-08-21T08:00:29Z

Content type: article

Language: en

Sources: [Securelist](<https://devfeed.tech/sources/securelist.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Android](<https://devfeed.tech/topics/android.md>), [proxy](<https://devfeed.tech/topics/proxy.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>), [Cybercrime](<https://devfeed.tech/topics/cybercrime.md>), [Embedded Software Dev](<https://devfeed.tech/topics/embedded-software-dev.md>)

Tags: [adware](<https://devfeed.tech/tags/adware.md>), [android](<https://devfeed.tech/tags/android.md>), [automotive](<https://devfeed.tech/tags/automotive.md>), [automotive-security](<https://devfeed.tech/tags/automotive-security.md>), [badbox](<https://devfeed.tech/tags/badbox.md>), [botnets](<https://devfeed.tech/tags/botnets.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [dropper](<https://devfeed.tech/tags/dropper.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [full](<https://devfeed.tech/tags/full.md>), [google-android](<https://devfeed.tech/tags/google-android.md>), [infection-chain](<https://devfeed.tech/tags/infection-chain.md>), [kaspersky](<https://devfeed.tech/tags/kaspersky.md>), [large](<https://devfeed.tech/tags/large.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-descriptions](<https://devfeed.tech/tags/malware-descriptions.md>), [malware-technologies](<https://devfeed.tech/tags/malware-technologies.md>), [medium](<https://devfeed.tech/tags/medium.md>), [mqtt](<https://devfeed.tech/tags/mqtt.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [thumbnail](<https://devfeed.tech/tags/thumbnail.md>), [trojan](<https://devfeed.tech/tags/trojan.md>), [trojan-clicker](<https://devfeed.tech/tags/trojan-clicker.md>)

### AI overview

Kaspersky reports Android malware delivered through legitimate software updaters for DoFun automotive head units. The multi-stage downloader is used for ad fraud and to create a proxy botnet, and the activity is attributed to the MoYu Group, which is linked to BADBOX.

### Source excerpt

Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.

## Armored Likho expands its cyber-espionage toolkit

DevFeed: [Armored Likho expands its cyber-espionage toolkit](<https://devfeed.tech/articles/armored-likho-expands-its-cyber-espionage-toolkit-48824.md>)

Original publisher: [Read original article](<https://securelist.com/armored-likho-still-toolkit/121033/>)

Author: Konstantin Isakov

Published: 2026-08-13T08:00:15Z

Content type: article

Language: en

Sources: [Securelist](<https://devfeed.tech/sources/securelist.md>)

Topics: [infection chain](<https://devfeed.tech/topics/infection-chain.md>), [C2](<https://devfeed.tech/topics/c2.md>), [API](<https://devfeed.tech/topics/api.md>), [kaspersky](<https://devfeed.tech/topics/kaspersky.md>), [Rust](<https://devfeed.tech/topics/rust.md>), [Tauri](<https://devfeed.tech/topics/tauri.md>), [App](<https://devfeed.tech/topics/app.md>), [Framework](<https://devfeed.tech/topics/framework.md>), [data](<https://devfeed.tech/topics/data.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [app](<https://devfeed.tech/tags/app.md>), [apt](<https://devfeed.tech/tags/apt.md>), [apt-reports](<https://devfeed.tech/tags/apt-reports.md>), [armored-likho](<https://devfeed.tech/tags/armored-likho.md>), [audio-surveillance](<https://devfeed.tech/tags/audio-surveillance.md>), [command-and-control](<https://devfeed.tech/tags/command-and-control.md>), [cyber](<https://devfeed.tech/tags/cyber.md>), [cyber-espionage](<https://devfeed.tech/tags/cyber-espionage.md>), [dropper](<https://devfeed.tech/tags/dropper.md>), [eavesdropping](<https://devfeed.tech/tags/eavesdropping.md>), [espionage](<https://devfeed.tech/tags/espionage.md>), [files](<https://devfeed.tech/tags/files.md>), [framework](<https://devfeed.tech/tags/framework.md>), [full](<https://devfeed.tech/tags/full.md>), [great-research](<https://devfeed.tech/tags/great-research.md>), [infection-chain](<https://devfeed.tech/tags/infection-chain.md>), [kaspersky](<https://devfeed.tech/tags/kaspersky.md>), [large](<https://devfeed.tech/tags/large.md>), [logs](<https://devfeed.tech/tags/logs.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-descriptions](<https://devfeed.tech/tags/malware-descriptions.md>), [malware-technologies](<https://devfeed.tech/tags/malware-technologies.md>), [medium](<https://devfeed.tech/tags/medium.md>), [rust](<https://devfeed.tech/tags/rust.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [still-toolkit](<https://devfeed.tech/tags/still-toolkit.md>), [targeted-attacks](<https://devfeed.tech/tags/targeted-attacks.md>), [tauri](<https://devfeed.tech/tags/tauri.md>), [telegram](<https://devfeed.tech/tags/telegram.md>), [thumbnail](<https://devfeed.tech/tags/thumbnail.md>), [trojan](<https://devfeed.tech/tags/trojan.md>), [trojan-stealer](<https://devfeed.tech/tags/trojan-stealer.md>)

### AI overview

Kaspersky researchers describe an Armored Likho cyber-espionage campaign that uses a fake donation app to deliver the Rust-based Still Toolkit. Its components steal Telegram session data and conduct covert audio surveillance.

### Source excerpt

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.