In June 2026, we discovered an unusual new piece of malware targeting… Android-based car head units. This is the first documented case of malware being delivered to automotive head units via an automatic firmware-update service. We’ve covered automotive cyber-incidents many times before, but those were generally related either to data leaks in manufacturers’ digital infrastructure , or to security researchers’ experiments . This case, however, involves malware that cybercriminals are distributing in the wild . Their goals are ad fraud and creation of a proxy botnet made up of infected automotive head units. In this article, we explain what a head unit is, how exactly attackers infect these devices, and what this could mean for drivers. What is a car head unit (HU)? First, let’s clarify what a car head unit actually is. The term may sound technical, but in reality, most drivers interact with one every time they use their car. A head unit is the vehicle’s infotainment system — usually centered around a display used to control navigation, music, and other vehicle functions. In modern cars, head units are often connected to the internet. Manufacturers frequently use Android as the operating system for their head units — in part for simplicity’s sake: Android is designed to support automotive head-unit usage cases, bringing a number of advantages: extensive options for customizing the interface; easy app development; the ability to add one’s own system apps and components; a large existing app ecosystem. However, those same advantages also create risks — because the apps involved may be malicious rather than legitimate. And that’s what’s happened here: using a malicious application, attackers have made cars part of a botnet. Here’s how… How do attackers infect car head units, and what malware do they use? First, it should be noted that this malware doesn’t affect all head units, but those specifically using software developed by the Chinese company DoFun. The company develops firmware, applications, and cloud services for Android-based automotive infotainment systems and, according to its website , it serves more than 30 million vehicle owners worldwide. To deliver the malware to a car’s infotainment system, the attackers use TWCore, a legitimate system app responsible for software updates on DoFun head units. Under normal circumstances, TWCore obtains information from the developer’s cloud about files that need to be downloaded and installed on the device. These are primarily updates for software already installed on the head unit, but the same mechanism can be used to install entirely new apps. And this is precisely what the attackers exploit: they use TWCore to install JarService — a malicious Trojan dropper — on head units. JarService is essentially an “empty” application. That is, it has no user interface, and makes no attempt to impersonate a legitimate service. The lack of an interface makes perfect sense in this case: the attackers don’t need to persuade the user to install the malware manually, and no user interaction whatsoever is required. The JarService code contains, in encrypted form, the next-stage payload, as well as information about its version and entry point. JarService’s job is to decrypt this data and launch the next stage of the infection: a malicious downloader. Once launched, the downloader connects to the attackers’ command-and-control (C2) server, and sends it information about the installed malware. In response, the server provides a link to the next-stage payload. The downloader retrieves the payload, decrypts it, and executes it. In this case, the malware installs what’s known as a clicker —a type of malware used to fraudulently inflate ad impressions. Once running, the malware regularly contacts the C2 server and sends it information about the infected device — including its model, screen resolution, MAC address, and details of the connected Wi-Fi network. In return, the malware can receive various co…

AI Analysis