458/69 Monday, August 24, 2026
Researchers from Kaspersky have published a report on Android malware targeting car head units, or infotainment systems and certain control components in vehicles. They described it as the first documented case of malware infection on a car head unit through an update mechanism specific to this type of device. The malware is designed as a multi-stage downloader, with its primary purpose being ad fraud and the creation of a proxy botnet rather than direct vehicle control. Android car head units are used in vehicles because they are flexible and can be developed based on Android source code. However, this also exposes such devices to risks similar to other Android devices, including the ability to run applications and certain types of malware.
Analysis found that the infection chain begins with TWCore, a legitimate system app on DoFun head units that is normally involved in analytics and firmware updates. TWCore receives commands through an MQTT message broker to download and install APK files, while a flag named installNotExists
affects whether the system checks if an app is already installed. If the flag is configured in a way that permits installation, the normal update channel can become a mechanism for installing applications specified by the attacker. The first-stage malware installed is a dropper named JarService, which has no user interface and is responsible for decrypting and loading the next stage. The loader then contacts a C2 server, sends basic device information, and receives a link to download the third-stage payload, which functions as a clicker and reverse proxy. It periodically communicates with the server to receive new commands.
Kaspersky stated that the malware’s command system has several capabilities, including changing the clipboard, sending HTTP requests, loading web pages, and running JavaScript. In practice, the attackers primarily used commands to download additional code and send web requests. An additional module named “zhima” functions as a reverse proxy, allowing the internet connection of infected vehicles to be used as part of a large proxy network. Researchers linked this campaign to MoYu Group with high confidence. The group has been associated with the BADBOX botnet, which was previously observed on devices such as smart TVs and set-top boxes. This incident shows that internet-connected in-vehicle devices can be abused as botnet infrastructure in the same way as other IoT devices. Manufacturers and users should therefore prioritize the security of firmware updates, update channels, and continuous inspection of applications installed on infotainment systems.
Source: https://securityaffairs.com/197700/hacking/malware-hijacks-android-car-head-units.html