Malware in car infotainment systems: how infection occurs | Kaspersky official blog

This malware campaign targets Android-based automotive infotainment systems specifically using DoFun's software, affecting over 30 million vehicles worldwide. Attackers exploit the TWCore update mechanism to silently install JarService, a Trojan dropper without a user interface. JarService decrypts and executes a downloader that communicates with a C2 server to retrieve further payloads, including a clicker for ad fraud and a botnet module named zhima. The infected head units become part of a proxy botnet infrastructure linked to the MoYu Group and the BADBOX platform, enabling attackers to route malicious traffic through these devices. The malware impacts system performance and network speed and can receive commands to download and execute additional malicious code. Kaspersky notified the developer, who subsequently addressed the security flaws.

The malware enables attackers to incorporate infected car infotainment systems into a botnet used for ad fraud and proxy services, potentially degrading the performance and stability of the head unit and reducing internet connection speeds. The infection vector requires no user interaction, increasing the risk of widespread compromise. The ability to download and execute additional malicious code means the impact could evolve depending on attacker intent. The compromised devices provide attackers with proxy infrastructure that can be monetized and used for further malicious activities.

The developer of the affected infotainment systems was informed of the malware distribution method and has addressed the security issues. Users should ensure their head units receive official updates from the manufacturer or authorized sources. Since the malware exploits the legitimate update mechanism, verifying update authenticity and integrity is critical. No additional user action is required if the device has been updated with the vendor's fixes.