Cars
In June 2026, we discovered an unusual new piece of malware targeting… Android-based car head units. This is the first documented case of malware being delivered to automotive head units via an automatic firmware-update service. We’ve covered automotive cyber-incidents many times before, but those were generally related either to data leaks in manufacturers’ digital infrastructure, or to security researchers’ experiments.
This case, however, involves malware that cybercriminals are distributing in the wild. Their goals are ad fraud and creation of a proxy botnet made up of infected automotive head units. In this article, we explain what a head unit is, how exactly attackers infect these devices, and what this could mean for drivers.
What is a car head unit (HU)?
First, let’s clarify what a car head unit actually is. The term may sound technical, but in reality, most drivers interact with one every time they use their car. A head unit is the vehicle’s infotainment system — usually centered around a display used to control navigation, music, and other vehicle functions. In modern cars, head units are often connected to the internet.
Manufacturers frequently use Android as the operating system for their head units — in part for simplicity’s sake: Android is designed to support automotive head-unit usage cases, bringing a number of advantages:
- extensive options for customizing the interface;
- easy app development;
- the ability to add one’s own system apps and components;
- a large existing app ecosystem.
However, those same advantages also create risks — because the apps involved may be malicious rather than legitimate. And that’s what’s happened here: using a malicious application, attackers have made cars part of a botnet. Here’s how…
How do attackers infect car head units, and what malware do they use?
First, it should be noted that this malware doesn’t affect all head units, but those specifically using software developed by the Chinese company DoFun. The company develops firmware, applications, and cloud services for Android-based automotive infotainment systems and, according to its website, it serves more than 30 million vehicle owners worldwide.
To deliver the malware to a car’s infotainment system, the attackers use TWCore, a legitimate system app responsible for software updates on DoFun head units. Under normal circumstances, TWCore obtains information from the developer’s cloud about files that need to be downloaded and installed on the device. These are primarily updates for software already installed on the head unit, but the same mechanism can be used to install entirely new apps. And this is precisely what the attackers exploit: they use TWCore to install JarService — a malicious Trojan dropper — on head units.
JarService is essentially an “empty” application. That is, it has no user interface, and makes no attempt to impersonate a legitimate service. The lack of an interface makes perfect sense in this case: the attackers don’t need to persuade the user to install the malware manually, and no user interaction whatsoever is required.
The JarService code contains, in encrypted form, the next-stage payload, as well as information about its version and entry point. JarService’s job is to decrypt this data and launch the next stage of the infection: a malicious downloader. Once launched, the downloader connects to the attackers’ command-and-control (C2) server, and sends it information about the installed malware. In response, the server provides a link to the next-stage payload. The downloader retrieves the payload, decrypts it, and executes it.
In this case, the malware installs what’s known as a clicker —a type of malware used to fraudulently inflate ad impressions. Once running, the malware regularly contacts the C2 server and sends it information about the infected device — including its model, screen resolution, MAC address, and details of the connected Wi-Fi network. In return, the malware can receive various commands from the attackers. For example, it can make HTTP requests and open web pages. But most importantly it can download and execute additional malicious code on the compromised car’s infotainment system.
Attackers use this capability to install a malicious module called zhima, which adds the infected head unit to a botnet. The resulting botnet powers a so-called residential proxy service, allowing attackers to route their traffic through infected devices when carrying out attacks and other malicious activity.
Who’s behind the malware, and what are the attackers trying to achieve?
The attackers infect car head units with malware primarily to expand their botnet. An investigation by Kaspersky experts has found that the operation is associated with the BADBOX malicious platform and, more specifically, with one of the threat actors linked to it: MoYu Group. Clues in the malware’s code, along with overlaps with infrastructure previously attributed to MoYu Group, point to the group’s involvement. BADBOX itself brings together a range of malicious activity centered on infecting Android devices and secretly exploiting their resources.
The attackers then make money by monetizing access to resources that belong to other people. While investigating the botnet infrastructure, our experts discovered links between MoYu Group and the PXYEDGE and ProxyForU services, which offer residential proxy services. These services allow clients around the world to route their internet traffic through devices connected to the botnet, thereby accessing the internet using those devices’ IP addresses. This suggests that infected car head units may already be being used as part of this infrastructure.
How does the malware affect users?
First and foremost, the malware consumes some of the head unit’s computing resources. The additional load may cause the car’s infotainment system to become slower or less stable. At the same time, the internet connection speed of the infected device is also very likely to decrease, as attackers may route significant amounts of traffic through it.
It’s also worth noting that the malware’s capabilities are not limited to providing proxy functionality. It can receive commands from the attackers, and download and execute additional malicious code. As a result, the consequences of an infection may vary depending on what payload the botnet operators decide to install on the device.
Conclusion
This case demonstrates once again that attacks on all kinds of internet-connected devices — from TV set-top boxes to car infotainment systems — are not merely theoretical, but very much a reality. Attackers are constantly looking for new devices whose resources they can exploit for their own purposes, so malware protection now matters far beyond computers and smartphones.
Our experts informed the developer about the malware distribution scheme they identified, after which the developer addressed the security issues that had been discovered.
A full technical analysis of the malware is available on Securelist.
What other methods can attackers use to hack a car, and what risks do they pose to drivers? Read more in our posts:
