Listen to this Post
Introduction: When the Car’s Own Software Becomes the Attack Path
Modern cars are increasingly computers on wheels. Their infotainment systems connect to the internet, download software updates, communicate with cloud services, support navigation, and in some cases interact with parts of the vehicle itself. That connectivity creates convenience for drivers—but it also creates another potential doorway for cybercriminals.
A new investigation from Kaspersky shows just how serious that risk can become. Researchers discovered Android malware specifically targeting vehicle head units associated with DoFun, with attackers abusing the legitimate TWCore system application responsible for software updates. Rather than tricking drivers into installing a suspicious application, the attackers found a far more powerful route: they used the device’s own trusted update mechanism to deliver malware.
Kaspersky described this as the first documented malware infection chain specifically designed around Android automotive head units. The campaign was discovered in June 2026 and was publicly detailed in August. Researchers believe the activity may be connected to the MoYu Group, an operation associated with the BadBox botnet ecosystem.
The immediate objective does not appear to be taking control of steering, braking, or the vehicle’s powertrain. Instead, the infected head units can be turned into tools for advertising fraud and proxy-network activity. That distinction is important—but it does not make the discovery harmless. It demonstrates that connected automotive hardware is now attractive enough to be incorporated into criminal infrastructure.
The Core Discovery: Malware Hidden Inside a Trusted Update Chain
Kaspersky found that attackers were abusing TWCore, a legitimate system application installed on affected DoFun Android head units. TWCore normally handles analytics and software updates, meaning it has privileges and responsibilities that ordinary applications do not have.
The attackers exploited that trust relationship. Instead of asking the vehicle owner to download an unknown APK, malware could be delivered through the same update pathway the device was already designed to trust.
This is one of the most important aspects of the incident. Traditional Android malware often depends on social engineering, malicious applications, phishing, or users enabling installation from unknown sources. In this case, the dangerous component was connected to an established software-distribution mechanism.
The malicious dropper identified by Kaspersky as JarService operated without a normal user interface. That helped keep the infection largely invisible to the driver while additional malicious components could be downloaded and activated in the background.
DoFun Head Units Became an Unexpected Target
The affected systems are Android-based automotive head units developed around DoFun technology. These devices can be installed in vehicles as factory equipment or added later as aftermarket infotainment systems. Kaspersky noted that DoFun software is used in a large number of automotive systems and that the company serves more than 30 million vehicle owners worldwide, according to information cited in its research.
Android is particularly attractive for these systems because manufacturers can customize the operating environment, add applications, integrate navigation, and connect the device to cloud services. But the same flexibility also means Android malware can potentially operate on automotive hardware.
That makes an Android head unit more than a simple entertainment screen. It can be a permanently connected computing device sitting inside a vehicle.
How the Infection Chain Worked
The attack began with the legitimate TWCore updater. Under normal circumstances, the application receives instructions concerning software that needs to be downloaded or updated.
Researchers found that this mechanism could also be used to install applications that were not previously present on the device. The attackers leveraged this functionality to introduce JarService into the head unit.
Once installed, JarService acted as the beginning of a multi-stage infection chain. Its purpose was not simply to display a visible malicious application. Instead, it helped establish the next stages of the operation while attempting to remain unnoticed.
Kaspersky identified multiple commands that could be used to display unwanted advertising, perform advertising fraud, and download additional malicious modules. The malware also collected technical information about the infected device, including its model, display characteristics, Wi-Fi network identifier, and MAC address.
The Car Was Valuable Because It Was Connected
The most revealing part of the campaign is that criminals did not necessarily need access to valuable information stored inside the vehicle.
A connected head unit can have another form of value: its internet connection.
If criminals control thousands of connected Android devices, they can potentially use those devices as infrastructure for advertising fraud, traffic manipulation, proxy services, or other operations. Kaspersky’s investigation found evidence connecting the campaign to the broader MoYu ecosystem and BadBox-related activity.
In other words, the vehicle became useful not because it was a car, but because it was an internet-connected computer.
The BadBox Connection Raises the Stakes
Kaspersky believes the campaign may be linked to MoYu Group, a threat actor associated with the BadBox botnet. BadBox has previously been associated with compromised Android devices being used for fraudulent activity and proxy-related operations.
The connection does not mean that every infected DoFun head unit is automatically part of a massive BadBox campaign. Attribution in cybersecurity is rarely that simple.
However, similarities in infrastructure and malware behavior gave researchers reason to connect the activity with the broader ecosystem. The possibility that an established Android botnet operation is expanding into automotive hardware is what makes this development particularly significant.
This Is Not the Same as Remote Vehicle Hijacking
One of the most important points should not be lost in the headlines.
The research does not establish that attackers could remotely take control of a vehicle’s brakes, steering, accelerator, or other safety-critical systems through this campaign.
The documented objectives were primarily advertising fraud, malicious module deployment, and proxy-botnet activity.
That distinction matters because sensational headlines could easily turn a malware infection in an infotainment system into a claim of full remote car takeover.
The real story is still serious enough without exaggeration: criminals demonstrated that an automotive Android platform could be incorporated into a malware distribution and botnet infrastructure.
Why Automatic Updates Can Become a Security Weakness
Software updates are normally one of the strongest defenses against cybersecurity problems. They allow vendors to patch vulnerabilities, fix bugs, and improve security without requiring users to manually reinstall their systems.
But an update mechanism has enormous authority.
If attackers compromise the distribution channel, manipulate update instructions, steal signing credentials, compromise backend infrastructure, or abuse a weakness in the updater itself, that same trusted mechanism can become an extremely efficient malware-delivery system.
This is why software supply-chain security has become such a major issue across smartphones, computers, cloud services, industrial systems, and now vehicles.
The Difference Between Android Auto and an Android Head Unit
Another important clarification is that this incident should not automatically be interpreted as an attack against Google’s Android Auto phone-projection service.
The research concerns Android-based automotive head units associated with DoFun. These devices can run applications and system components directly on the head unit itself.
That distinction is critical for drivers who may see the phrase “Android car malware” and assume their Android smartphone or Android Auto connection has been compromised.
The vulnerable architecture described by Kaspersky is much more specific.
DoFun Has Reportedly Fixed the Problem
Kaspersky said it notified DoFun about the abuse of the software-distribution mechanism. According to the company, the issue was subsequently fixed.
That is an important development, but fixing the server-side or software-distribution problem does not necessarily answer every question about previously infected devices.
Organizations responsible for connected automotive hardware need to consider whether already-compromised devices require additional remediation, whether malicious applications remain installed, and whether older firmware versions continue to expose similar weaknesses.
The Forgotten Security Problem of Aftermarket Devices
Aftermarket Android head units deserve particular attention.
Factory-installed automotive systems are typically developed within a broader vehicle security architecture. They may have formal update policies, security testing, hardware isolation, and longer support cycles.
Cheap aftermarket Android systems can have very different security practices.
Some devices receive limited software support, use customized Android builds, rely on third-party system applications, and remain connected to the internet long after their manufacturers stop actively maintaining them.
The Kaspersky case shows why these devices should not be treated as harmless accessories.
A New Category of IoT Device Is Emerging
For years, cybersecurity researchers warned about smart televisions, routers, cameras, streaming boxes, and other internet-connected devices being absorbed into botnets.
Automotive head units now fit naturally into that category.
They have processors, storage, operating systems, applications, network connectivity, update mechanisms, and often privileged system software.
From an
The only difference is where the computer happens to be located.
Why Criminals May Keep Targeting Cars
Cybercriminals usually follow economics.
If compromising an ordinary Android device generates money, attackers look for more devices.
If a connected car contains a computer with an internet connection and a weakly protected software ecosystem, there is little reason for criminals to ignore it.
The goal does not have to be stealing the vehicle.
A compromised head unit can potentially become another node in a larger criminal infrastructure.
That makes automotive cybersecurity increasingly relevant even when the attack does not directly threaten physical vehicle control.
Deep Analysis
The Most Dangerous Part Is the Trust Model
The central security lesson is not simply that Android malware reached a car. It is that the malware traveled through a mechanism the device was designed to trust.
Trust is extremely valuable in computing, and attackers continuously search for places where that trust can be converted into execution privileges.
The Updater Had More Power Than an Ordinary App
A normal application asking to install another application may trigger warnings or require user interaction.
A system updater is different.
Its entire purpose is to download and install software automatically.
That makes the updater one of the most sensitive components in the device.
Supply-Chain Attacks Are Becoming More Attractive
Attackers increasingly understand that compromising one distribution point can be more profitable than attacking thousands of individual users.
Instead of convincing every driver to install malware, compromising a trusted distribution mechanism can potentially reach many devices simultaneously.
Automotive Systems Expand the Attack Surface
Every new connected feature creates another software component, communication channel, API, cloud service, or update mechanism.
Cars are becoming software platforms, and software platforms inevitably inherit software-security problems.
The Internet Connection Is the Prize
For this particular campaign, the internet connection appears to have been more valuable than direct access to vehicle functions.
That is a useful reminder that attackers do not always want the thing consumers think they want.
Sometimes they simply want another connected machine.
Botnets Are Evolving Beyond PCs and Phones
Botnets once focused heavily on Windows computers.
Then routers, cameras, DVRs, smart TVs, Android boxes, and mobile devices became common targets.
Connected automotive systems represent another logical expansion.
BadBox Makes the Automotive Angle More Interesting
The alleged relationship with MoYu and BadBox suggests that criminal groups already experienced in Android botnets may be willing to experiment with new hardware categories.
That could make automotive devices part of a much broader ecosystem.
Automotive Malware Does Not Need to Be Safety-Critical to Matter
A malware infection does not need to control steering to create damage.
It can consume bandwidth, generate fraudulent traffic, expose device information, create proxy infrastructure, interfere with legitimate services, or become a stepping stone toward other systems.
The Update Server Becomes a High-Value Asset
Manufacturers should treat update infrastructure almost like a root-level credential.
Access must be tightly controlled.
Update commands should be authenticated, monitored, logged, and independently validated.
Installing Previously Unknown Applications Is Risky
An updater capable of installing applications that were not previously present creates additional flexibility.
It also creates additional risk.
That functionality needs strict authorization controls and should never rely solely on assumptions about the integrity of upstream commands.
Cloud Infrastructure Matters as Much as the Device
The head unit itself may be secure while the backend distribution infrastructure is not.
That means automotive security teams need visibility across both endpoints and cloud systems.
Device Identity Needs Protection
Technical identifiers such as MAC addresses and network information may appear harmless individually.
At scale, however, device telemetry can help attackers profile their infrastructure and manage compromised systems.
Visibility Is a Major Challenge
Drivers may never notice that their infotainment system is compromised.
There may be no obvious pop-up, crash, or warning.
That makes centralized telemetry and anomaly detection particularly important for manufacturers.
Old Vehicles Can Remain Exposed
An aftermarket head unit can outlive the
A ten-year-old vehicle can therefore contain a relatively modern internet-connected Android computer with uncertain long-term security support.
Security Support Must Become Part of the Purchase Decision
Consumers often compare screens, processors, navigation features, RAM, and storage when purchasing aftermarket head units.
Security support should become another major consideration.
Cheap Hardware Can Have Expensive Consequences
A low-cost head unit may appear insignificant compared with the price of the vehicle.
But if it becomes part of a criminal proxy network, its value to attackers can be far greater than its retail price.
Automotive Manufacturers Need Better Asset Inventories
Manufacturers should know which operating systems, applications, libraries, update services, and communication protocols exist across their vehicle ecosystem.
Without an accurate inventory, vulnerabilities can remain hidden for years.
Security Testing Must Include Update Paths
Testing only the installed firmware is not enough.
Security teams should test how software gets delivered, authenticated, downloaded, validated, and installed.
The update mechanism itself must be treated as part of the attack surface.
Cryptographic Verification Should Be Mandatory
Software updates should use strong cryptographic verification and secure signing practices.
Devices should reject unauthorized packages even if attackers manage to manipulate surrounding infrastructure.
Backend Credentials Need Strong Protection
Signing keys, update credentials, cloud administrator accounts, and deployment tokens can become extremely valuable targets.
Protecting those assets should be considered a critical automotive-security requirement.
Segmentation Can Reduce Damage
Even when a head unit is compromised, strong isolation can limit what the compromised system can reach.
Infotainment systems should not automatically have unrestricted access to safety-critical vehicle networks.
The Architecture Matters More Than the Brand Name
The lesson extends beyond DoFun.
Any connected automotive platform that uses Android or another general-purpose operating system can potentially face similar classes of problems.
The exact vulnerability may differ, but the underlying architectural risk remains.
Aftermarket Hardware Needs Regulatory Attention
As connected aftermarket systems become increasingly common, regulators and manufacturers may need clearer minimum security requirements for software updates, support lifetimes, authentication, and vulnerability disclosure.
Security Researchers Will Watch This Category Closely
Once attackers demonstrate that a new device category can generate money, other criminal groups tend to investigate it.
That means this campaign could encourage additional research into automotive Android systems.
Malware Developers Learn From Every Successful Campaign
Even unsuccessful campaigns provide attackers with information.
A malware operation that discovers which components work, which permissions are available, and which systems are poorly protected can become a blueprint for future campaigns.
Vehicle Owners Should Not Panic
The discovery does not mean every Android-equipped car is infected.
The documented campaign is associated with specific DoFun-based head units, and DoFun has reportedly addressed the abused mechanism.
But Owners Should Take Updates Seriously
If a vehicle manufacturer or head-unit vendor provides a security update, installing it is one of the simplest ways to reduce exposure.
The irony of this campaign is that updates became the attack path—but legitimate security updates remain one of the strongest defenses.
The Industry Needs Better Transparency
Consumers should be told what operating system their head unit uses, how long it will receive security updates, how updates are authenticated, and what happens when vulnerabilities are discovered.
Automotive Cybersecurity Is Becoming Consumer Cybersecurity
Drivers increasingly need to think about their cars the way they think about phones, laptops, routers, and smart-home devices.
The security of the vehicle now depends partly on software.
The Second Claim About Exposed Git Repositories Deserves Separate Verification
The supplied post also mentions a claim involving more than 28,000 exposed Git repositories across approximately 3.5 million hosts, allegedly exposing AWS, Stripe, OpenAI, Telegram, and GitHub secrets.
That claim was not substantiated by the Kaspersky automotive research reviewed for this article, so it should not be presented as part of the same confirmed incident.
It may describe a separate cybersecurity investigation, but without a reliable primary source, the exact numbers and affected organizations should be treated cautiously rather than repeated as established fact.
The Bigger Picture Is Still Clear
Whether the target is a car, television, router, cloud server, or Git repository, the recurring cybersecurity lesson is the same: trusted systems become dangerous when trust is not properly protected.
The automotive industry is now entering a period where software security will be just as important as mechanical reliability.
What Undercode Say:
A New Kind of Car Threat
This incident is important because it moves automotive malware beyond theoretical demonstrations and into an observed criminal campaign.
Trust Is the Real Attack Surface
The attackers did not need to convince drivers to click suspicious links. They targeted the mechanism the device already trusted.
Cars Are Becoming Botnet Candidates
Connected head units provide processors, storage, networking, and persistent connectivity—exactly the ingredients that make ordinary Android devices useful to botnet operators.
The Attack Is Economically Motivated
The observed objectives point toward advertising fraud and proxy infrastructure rather than immediate physical sabotage.
That Does Not Make It Harmless
A device used for criminal proxy traffic can still create privacy, bandwidth, operational, and security problems.
The BadBox Connection Matters
If the MoYu attribution is correct, an established Android criminal ecosystem is experimenting with automotive hardware.
Aftermarket Devices Are Especially Interesting
The aftermarket market contains a huge variety of Android hardware, firmware, and software ecosystems.
Security Lifecycles Are Often Unclear
A device can remain installed in a vehicle for years after meaningful security support has ended.
Automatic Updates Need Strong Controls
An updater should never become an unrestricted remote application installer without robust authentication and authorization.
Software Signing Is Critical
Cryptographic verification should prevent unauthorized packages from being accepted even if other parts of the distribution chain are compromised.
Backend Security Is Equally Important
Manufacturers must protect the servers and credentials that control what connected vehicles receive.
Isolation Can Limit Consequences
Infotainment networks should be separated from safety-critical systems wherever possible.
The Headlines Need Accuracy
Calling this a remote car-hijacking campaign would go beyond the evidence currently available.
The Evidence Supports a Botnet Story
The documented activity supports a story about malware delivery, ad fraud, proxy activity, and automotive head units becoming criminal infrastructure.
Automotive Android Needs More Scrutiny
Researchers should continue auditing the operating systems and update mechanisms used by aftermarket automotive hardware.
Consumers Need Better Information
Buyers should know whether their head unit has a security-support lifecycle before installing it.
Security Cannot Be an Afterthought
Internet connectivity should never be added to a vehicle without considering how the software will be maintained securely for years.
The Industry Should Learn From IoT
The history of insecure cameras, routers, and Android boxes provides a warning about what happens when connected devices are shipped without long-term security planning.
Botnets Follow Opportunity
Criminal groups do not care whether a compromised processor sits inside a television or a dashboard.
Connectivity Creates Value for Attackers
The moment a device gains permanent internet access, it can become interesting to someone looking for infrastructure.
The Update Path Should Be Defended Like a Crown Jewel
A compromised update channel can potentially turn a legitimate security feature into a malware distribution system.
This Could Be an Early Warning
The current campaign appears relatively focused, but it could represent an early example of a much broader trend.
More Automotive Malware Is Likely
As vehicles become more software-defined, researchers and attackers will inevitably spend more time examining their operating systems.
The Security Model Must Change
Automotive companies need to think like software companies because their products increasingly depend on software.
Patch Management Must Extend to Cars
Security updates should not stop when a vehicle leaves the dealership.
Old Vehicles Need Protection Too
Aftermarket connected devices can introduce new vulnerabilities into otherwise older vehicles.
Security Support Should Have a Defined End Date
Manufacturers should clearly state how long connected automotive hardware will receive security fixes.
Transparency Builds Trust
Clear vulnerability disclosures and timely patches can prevent uncertainty from becoming a larger security problem.
The Biggest Lesson Is Architectural
The campaign demonstrates that security depends not only on whether an application is malicious, but also on which trusted components are allowed to install and execute software.
The Second Cybersecurity Claim Should Stay Separate
The reported Git repository exposure figures may represent another serious issue, but they require independent verification before being treated as confirmed.
The Threat Landscape Is Converging
Cars, phones, smart TVs, routers, cloud infrastructure, and developer systems are increasingly connected to the same criminal ecosystem.
Attackers Are Looking for the Weakest Link
Any overlooked system with connectivity and privileges can become the next entry point.
The Future of Car Security Is Software Security
Mechanical security remains important, but connected vehicles now require continuous monitoring, patching, authentication, segmentation, and incident response.
The Final Warning
The most uncomfortable part of this story is not that malware can run inside a car.
It is that malware can arrive through the very mechanism designed to keep that car’s software up to date.
✅ Confirmed: Kaspersky publicly documented malware targeting Android-based DoFun automotive head units and said attackers abused the legitimate TWCore update mechanism to deliver malicious software.
✅ Confirmed: Kaspersky linked the campaign to activity it believes is associated with MoYu Group and the BadBox botnet ecosystem, while the observed objectives included advertising fraud and additional malicious activity rather than demonstrated control of steering or braking.
❌ Unverified in the supplied material: The separate claim about more than 28,000 exposed Git repositories on 3.5 million hosts leaking AWS, Stripe, OpenAI, Telegram, and GitHub secrets was not independently established by the sources reviewed here and should not be treated as confirmed without a primary investigation or credible supporting evidence.
Prediction
(+1) Automotive Android malware will become a larger cybersecurity category. As connected head units become more common, attackers will increasingly view them as another class of internet-connected endpoints that can generate money through botnets, advertising fraud, proxy networks, and potentially other criminal services.
(+1) Update infrastructure will receive more attention from security researchers. The DoFun case demonstrates why update mechanisms deserve the same level of scrutiny as exposed APIs, authentication systems, and cloud infrastructure.
(+1) Automotive vendors will increasingly adopt stronger software-signing and device-isolation controls. The industry has a strong incentive to prevent infotainment compromises from crossing into more sensitive vehicle networks.
(-1) Unsupported aftermarket head units will remain a significant weak point. Devices that receive little or no long-term security maintenance could become increasingly attractive targets as attackers search for large populations of permanently connected hardware.
(-1) A compromised infotainment system could become a persistent hidden problem for vehicle owners. Because malware can operate without an obvious interface, users may not realize that their device has become part of a criminal infrastructure.
(+1) The broader cybersecurity lesson will extend beyond cars. The same principle applies to every connected device with a privileged update mechanism: when the update path is compromised, the system’s strongest trust relationship can become its greatest weakness.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
