Security researchers have uncovered an unprecedented malware family that directly infects vehicle head units — the central module that integrates entertainment, navigation, and in some cases, partial vehicle controls — by exploiting the very firmware update mechanisms of the Android platform developed by Chinese manufacturer DoFun. This marks the first documented case of malware with an infection chain specifically designed for embedded automotive platforms, a troubling milestone signaling that the attack surface of the digitized automotive industry is expanding beyond traditional infotainment systems.
The discovery was made by the Kaspersky Global Research and Analysis Team (GReAT) in June 2026 and made public on August 21, 2026. The researchers, led by security specialist Dmitry Kalinin, traced a campaign that uses the firmware's own update functionality as an attack vector, bypassing all conventional security measures a user or the Android system would expect to encounter.
The infection vector is particularly sophisticated because it exploits a legitimate system application — called TWCore (com.tw.core) — which already possesses silent installation privileges. This application is responsible for collecting analytics metrics and receiving firmware updates in APK format, using an MQTT message broker hosted on the cardoor.cn subdomain. Under normal conditions, TWCore downloads an APK, checks whether the application is already installed, and, if not, prompts the user for approval before installation. The malware altered this behavior by modifying a parameter called installNotExists: when set to false, the updater checks for the application's presence; when set to true — which the malware does — it installs the arbitrary APK without any notification or user consent.
The malware itself begins with a dropper called JarService, which is silently installed by the head unit itself. Once installed, JarService executes a loader that deploys a malicious module with no graphical interface, operating entirely in the background. The final component sends periodic POST requests — every 90 minutes by default — to a command and control (C2) endpoint located at /cpc/api/task, transmitting detailed information about the infected device, including display resolution, device model, connected Wi-Fi network identifier, and MAC address.
Once compromised, the head unit supports nine different commands sent by the C2 server. These commands allow displaying unsolicited advertisements on the vehicle's screen, executing automated ad fraud operations, and downloading additional malicious modules. One of the most significant modules is "Zhima," a reverse proxy module previously documented by the Nokia Deepfield Emergency Response Team as being distributed through IPTV applications installed on cheap Android TV boxes. The connection between the two campaigns suggests that the same threat group operates across multiple embedded vectors.
Kaspersky attributes the campaign to the MoYu Group, a threat actor already associated with the notorious BadBox botnet. BadBox is a botnet infrastructure that targets embedded devices and vehicular information systems, and the transition to automotive head units represents a natural evolution of this group's attack surface. The primary motivation of the campaign is financial — ad fraud and proxy botnet recruitment for masking malicious traffic — rather than direct compromise of critical vehicle systems such as brakes or steering. Nevertheless, the existence of this infection chain in automotive hardware raises serious questions that extend well beyond the owner's privacy.
Engineers working with Android-based automotive platforms should treat any OTA updater that consumes remote instructions as a high-value target, not as passive infrastructure. The "updater-as-dropper" pattern is portable to any vendor whose update client trusts remote push instructions, making this discovery an attack template rather than an isolated incident.
Manufacturer DoFun was notified of the vulnerability and, according to researchers, has already patched the security issues. However, the fundamental question remains: how much remote update surface should be allowed on embedded devices that have physical access to the vehicle's network? The answer will define the future of automotive security.
Sources: The Hacker News, Kaspersky, Else If
✓ Independent sources cross-checked and verified before publishing
