Malware in car infotainment systems: how infection occurs | Kaspersky official blog

Attackers have found yet another source of free computing resources: automotive head units. We take a look at the first malware specifically targeting cars for infection.

Dmitry Kalinin

August 21, 2026

In June 2026, we discovered an unusual new piece of malware targeting… Android-based car head units. This is the first documented case of malware being delivered to automotive head units via an automatic firmware-update service. We’ve coveredautomotive cyber-incidentsmany times before, but those were generally related either to data leaks in manufacturers’digital infrastructure, or to security researchers’experiments.

This case, however, involves malware that cybercriminals are distributingin the wild. Their goals are ad fraud and creation of a proxybotnetmade up of infected automotive head units. In this article, we explain what a head unit is, how exactly attackers infect these devices, and what this could mean for drivers.

First, let’s clarify what a carhead unitactually is. The term may sound technical, but in reality, most drivers interact with one every time they use their car. A head unit is the vehicle’s infotainment system — usually centered around a display used to control navigation, music, and other vehicle functions. In modern cars, head units are often connected to the internet.

Manufacturers frequently use Android as the operating system for their head units — in part for simplicity’s sake: Android is designed to support automotive head-unit usage cases, bringing a number of advantages:

However, those same advantages also create risks — because the apps involved may be malicious rather than legitimate. And that’s what’s happened here: using a malicious application, attackers have made cars part of a botnet. Here’s how…

First, it should be noted that this malware doesn’t affect all head units, but those specifically using software developed by the Chinese company DoFun. The company develops firmware, applications, and cloud services for Android-based automotive infotainment systems and, according to itswebsite, it serves more than 30 million vehicle owners worldwide.

To deliver the malware to a car’s infotainment system, the attackers use TWCore, a legitimate system app responsible for software updates on DoFun head units. Under normal circumstances, TWCore obtains information from the developer’s cloud about files that need to be downloaded and installed on the device. These are primarily updates for software already installed on the head unit, but the same mechanism can be used to install entirely new apps. And this is precisely what the attackers exploit: they use TWCore to install JarService — a maliciousTrojan dropper— on head units.

JarService is essentially an “empty” application. That is, it has no user interface, and makes no attempt to impersonate a legitimate service. The lack of an interface makes perfect sense in this case: the attackers don’t need to persuade the user to install the malware manually, and no user interaction whatsoever is required.

The JarService code contains, in encrypted form, the next-stage payload, as well as information about its version and entry point. JarService’s job is to decrypt this data and launch the next stage of the infection: a malicious downloader. Once launched, the downloader connects to the attackers’ command-and-control (C2) server, and sends it information about the installed malware. In response, the server provides a link to the next-stage payload. The downloader retrieves the payload, decrypts it, and executes it.

In this case, the malware installs what’s known as a clicker —a type of malware used to fraudulently inflate ad impressions. Once running, the malware regularly contacts the C2 server and sends it information about the infected device — including its model, screen resolution, MAC address, and details of the connected Wi-Fi network. In return, the malware can receive various commands from the attackers. For example, it can make HTTP requests and open web pages. But most importantly it can download and execute additional malicious code on the compromised car’s infotainment system.

Attackers use this capability to install a malicious module calledzhima, which adds the infected head unit to a botnet. The resulting botnet powers a so-calledresidential proxyservice, allowing attackers to route their traffic through infected devices when carrying out attacks and other malicious activity.

The attackers infect car head units with malware primarily to expand their botnet. An investigation by Kaspersky experts has found that the operation is associated with theBADBOX malicious platformand, more specifically, with one of the threat actors linked to it: MoYu Group. Clues in the malware’s code, along with overlaps with infrastructure previously attributed to MoYu Group, point to the group’s involvement. BADBOX itself brings together a range of malicious activity centered on infecting Android devices and secretly exploiting their resources.

The attackers then make money by monetizing access to resources that belong to other people. While investigating the botnet infrastructure, our experts discovered links between MoYu Group and the PXYEDGE and ProxyForU services, which offer residential proxy services. These services allow clients around the world to route their internet traffic through devices connected to the botnet, thereby accessing the internet using those devices’ IP addresses. This suggests that infected car head units may already be being used as part of this infrastructure.

First and foremost, the malware consumes some of the head unit’s computing resources. The additional load may cause the car’s infotainment system to become slower or less stable. At the same time, the internet connection speed of the infected device is also very likely to decrease, as attackers may route significant amounts of traffic through it.

It’s also worth noting that the malware’s capabilities are not limited to providing proxy functionality. It can receive commands from the attackers, and download and execute additional malicious code. As a result, the consequences of an infection may vary depending on what payload the botnet operators decide to install on the device.

This case demonstrates once again that attacks on all kinds of internet-connected devices — from TV set-top boxes to car infotainment systems — are not merely theoretical, but very much a reality. Attackers are constantly looking for new devices whose resources they can exploit for their own purposes, so malware protection now matters far beyond computers and smartphones.

Our experts informed the developer about the malware distribution scheme they identified, after which the developer addressed the security issues that had been discovered.

A full technical analysis of the malware is available onSecurelist.

What other methods can attackers use to hack a car, and what risks do they pose to drivers? Read more in our posts:

We revisit the key rules for setting up IP cameras and related devices so that you don’t end up starring in a reality show — whether at home, in a hotel, or in rented accommodation.

We revisit the key rules for setting up IP cameras and related devices so that you don’t end up starring in a reality show — whether at home, in a hotel, or in rented accommodation.

Tom Fosters

August 19, 2026

We explain how to use AI the right way for schoolwork, how to fact-check chatbot responses, and how to protect your personal data.

We explain how to use AI the right way for schoolwork, how to fact-check chatbot responses, and how to protect your personal data.

Kaspersky Team

September 2, 2026

We break down the file formats that can be unfamiliar to some users, and that aren’t always scanned by security solutions but can still pose cyberthreats.

We break down the file formats that can be unfamiliar to some users, and that aren’t always scanned by security solutions but can still pose cyberthreats.

Stan Kaminsky

August 28, 2026

Handing it to a store manager or cashier, posting about it in your neighborhood chat, or just keeping it – these are common actions if a bank card is found on the street, but they’re also the wrong ones. Here’s what you should actually do.

Handing it to a store manager or cashier, posting about it in your neighborhood chat, or just keeping it – these are common actions if a bank card is found on the street, but they’re also the wrong ones. Here’s what you should actually do.

Kaspersky Team

August 27, 2026

Visit a familiar website, and along with the usual ad banner you could pick up a script that steals cryptocurrency. How can you protect yourself from attacks delivered through online ads?

Visit a familiar website, and along with the usual ad banner you could pick up a script that steals cryptocurrency. How can you protect yourself from attacks delivered through online ads?

Stan Kaminsky

August 11, 2026