Kaspersky Finds First Malware Built for Android Car Head Units, Delivered Through a Vendor Update App

Kaspersky has documented what it calls the first malware built specifically to infect Android car head units, the dashboard systems that combine multimedia and sometimes vehicle controls. The company said in a press release that it uncovered the campaign in June, and its researchers published technical details on Securelist.

Infected Through the Update Channel

The malware reached cars through the update mechanism built into the firmware of several Android head unit models powered by DoFun. A legitimate system app called TWCore, which collects analytics and pulls instructions from the manufacturer’s server about which apps to install or update, delivered a previously unknown dropper called JarService. In every case Kaspersky observed, the malware was installed by the com.tw.core package. Kaspersky notified DoFun, which said the issue has been fixed.

The infection runs in several stages designed to avoid detection. The final malware installs as an ordinary app with no user interface and runs in the background. Kaspersky found nine commands that can display unwanted ads, commit ad fraud as a clicker and download more malicious modules, and the malware reports device details such as model, screen resolution, Wi-Fi network identifier and MAC address.

In live attacks, the operators were mainly using a command that downloads “zhima,” a reverse proxy module. That turns the head unit into a node that relays other people’s internet traffic, which suits these devices because they often have SIM slots and constant connectivity but little personal data worth stealing.

Links to BADBOX

Kaspersky attributes the activity with high confidence to the MoYu Group, an actor tied to the BADBOX botnet of compromised Android TV boxes, phones and tablets. The botnet’s admin panel shares artifacts with the residential proxy services PXYEDGE and ProxyForU.

“Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BadBox botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide,” said Kaspersky security researcher Dmitry Kalinin. “In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app.”

Why It Matters

Kaspersky describes ad fraud and proxy traffic, not control of the car. The bigger concern is the delivery route. Aftermarket head units often run customized Android builds with vendor update apps that have system-level privileges, and when that channel is compromised, the owner has no practical way to notice. Fleet operators and anyone fitting aftermarket units should favor vendors with a track record of signed, auditable updates, and network teams can watch for head units generating unexpected proxy traffic.