Kaspersky discovers a malware campaign targeting car head units

Kaspersky uncovered a novel Android malware campaign targeting vehicle head units, marking the first documented case of an infection chain specifically designed for these systems. The malware was delivered through compromised firmware update mechanisms in multiple Android-based head units powered by DoFun.

The attack began with the legitimate TWCore system app, which manages analytics and software updates. Attackers exploited this trusted channel to distribute a stealthy, multi-stage downloader called JarService. Installed as a regular user application without a visible interface, the malware operated silently in the background.

The malware featured nine commands enabling attackers to display unwanted advertisements, conduct ad fraud, download additional malicious modules, and collect device information such as model, display resolution, Wi-Fi network identifier, and MAC address.

Kaspersky researchers linked the campaign to the MoYu Group, a threat actor associated with the BadBox botnet. BadBox is a large network of compromised Android devices used for ad fraud, data theft, and proxy traffic. Kaspersky notified DoFun, which subsequently fixed the abused software distribution mechanism.

“Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BadBox botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide. The delivery methods for such malware are becoming highly varied – ranging from pre-installed backdoors to compromised IPTV applications. In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app. Malicious actors are actively conquering new platforms. This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This servs as a warning that modern automotive platforms urgently require robust protection against malware,” comments Dmitry Kalinin, security researcher at Kaspersky.