This threat involves a supply-chain compromise of Android-based car head units sold by DoFun, where a legitimate system app (TWCore) was used to download a malicious APK called JarService. The malware decrypts and executes additional payloads, establishing communication with a command-and-control server. It supports multiple commands including HTTP requests, clipboard manipulation, webview JavaScript execution, and proxy functionality. The primary malicious activity is loading a reverse-proxy module ('zhima') that converts the head units into proxy botnet nodes for click fraud and residential proxy services. The malware does not interfere with vehicle control systems. Kaspersky researchers linked the operation to the MoYu threat actor group and reported the findings to DoFun, which responded that the problem was resolved.

Infected Android car head units become part of a proxy botnet used for advertising fraud and proxy monetization. This compromises device integrity and privacy but does not impact vehicle safety or driving functions. The infection enables attackers to remotely execute commands, exfiltrate device information, and use the devices as proxy nodes, potentially facilitating further malicious activities or abuse of network resources.

Kaspersky notified the vendor DoFun, which reportedly resolved the issue. Users and administrators should ensure their car head units receive official updates from the vendor. Since this is a supply-chain attack involving a legitimate app, verifying software integrity and applying vendor-provided fixes is critical. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.