Listen to this Post
Introduction: The Car Dashboard Has Become Another Cybersecurity Battlefield
For years, cybersecurity researchers warned that connected cars would eventually become attractive targets for attackers. That warning is no longer theoretical. Researchers have now uncovered an Android malware campaign that specifically targets vehicle infotainment hardware, using the software update mechanism built into certain car head units as the delivery path.
The discovery is significant because the attackers did not simply rely on users downloading a suspicious application. Instead, they abused a legitimate system component responsible for keeping automotive software updated. That distinction changes the threat dramatically. When malicious code enters through a trusted update mechanism, traditional assumptions about where malware comes from begin to break down.
Kaspersky researchers discovered the malware while investigating Android threats in June. What initially appeared to be an ordinary application inside the firmware of an Android-based automotive head unit turned out to be a multistage downloader with no conventional user interface.
The malware, identified as JarService, was found targeting head units manufactured by Chinese automotive technology company DoFun. According to the researchers, the infection chain abused a component called TWCore, which is responsible for updating software on the affected devices.
The immediate purpose of the campaign does not appear to be taking control of steering, braking, acceleration, or other safety-critical vehicle systems. Instead, the compromised devices can become part of a larger cybercrime infrastructure used for activities such as click fraud and proxy services.
That may sound less frightening than a scenario involving remote control of a moving vehicle. But the underlying security problem is arguably more important: a legitimate automotive software-update mechanism became the malware’s weapon.
A New Chapter in Android Malware
Malware Moves Beyond Phones and TVs
Android malware is usually associated with smartphones, tablets, smart TVs, inexpensive IoT devices, and other consumer electronics. Vehicle head units have received considerably less attention, despite increasingly resembling connected Android computers.
Modern infotainment systems can include Wi-Fi, Bluetooth, cellular connectivity, GPS, microphones, application frameworks, storage, and access to online services. Some also communicate with other vehicle systems.
That makes them attractive nodes for criminals who are not necessarily interested in the vehicle itself.
The Head Unit Is an Internet-Connected Computer
Kaspersky researcher Dmitry Kalinin described automotive head units as Internet-connected devices that can sometimes include SIM-card functionality and provide navigation and entertainment services.
From an
The device may not contain valuable personal files or corporate documents, but it can provide something increasingly valuable to cybercriminals: a persistent Internet-connected machine that can be remotely controlled.
Why Attackers Want Infected Cars
The objective of this campaign appears to be botnet recruitment rather than direct vehicle theft.
An infected head unit can potentially contribute bandwidth, computing resources, network identity, or automated activity to a criminal operation.
That can be monetized through advertising fraud, proxy networks, automated traffic, credential attacks, or other forms of abuse.
The vehicle therefore becomes less of a target and more of a resource.
JarService: Malware Without a Traditional Interface
A Suspicious Application Inside Firmware
The initial discovery was unusual because researchers found an application inside the firmware of a car head unit that appeared to be an ordinary Android component.
There was one major problem.
It had no normal user interface.
Instead of presenting menus, buttons, or settings, the application functioned as a multistage malware downloader.
The Downloader Is Only the Beginning
A downloader is particularly dangerous because it does not necessarily contain every malicious capability from the beginning.
Its first responsibility can simply be establishing persistence and downloading additional components.
That approach gives attackers flexibility.
They can modify the payload later, deploy different modules to different victims, and potentially expand the capabilities of compromised devices without replacing the initial infection mechanism.
The Infection Chain
The campaign reportedly uses several stages:
A malicious component enters the Android-based head unit.
The malware abuses the legitimate update infrastructure.
The update mechanism installs software that should not normally be present.
JarService establishes the next stage of the infection.
Additional malicious modules are downloaded.
A click-fraud component can generate fraudulent advertising activity.
A reverse-proxy component can potentially turn the compromised device into a network intermediary.
This is considerably more sophisticated than simply installing a malicious APK.
The Dangerous Part: A Legitimate Update Mechanism
TWCore Became the Attack Surface
The most important technical detail in the campaign is TWCore, an application included in DoFun firmware for software updates.
Software-update systems are normally considered security-critical components.
They are trusted because they need elevated privileges to install new software.
That trust becomes dangerous when the update component does not sufficiently verify what it is installing.
Abusing Legitimate Functionality
According to
Attackers apparently leveraged that functionality to introduce the malicious loader.
This is a classic example of a trusted-functionality abuse scenario.
The malware does not necessarily need to defeat every security control on the device if it can persuade a privileged system component to perform the installation itself.
Why This Is More Serious Than a Malicious App
A conventional malicious application usually depends on social engineering.
Someone downloads it.
Someone installs it.
Someone grants permissions.
A compromised update mechanism can bypass much of that interaction.
The user may never see anything suspicious.
There may be no warning.
There may be no obvious application icon.
There may be no reason for the driver or passenger to suspect anything is wrong.
That makes software-update security one of the most important lessons from this incident.
The Good News: No Evidence of Immediate Physical Vehicle Control
Infotainment Is Not Automatically Vehicle Control
The discovery naturally raises an alarming question: can malware in an automotive head unit take control of the vehicle?
Based on
That distinction matters.
Modern vehicles contain numerous electronic systems, but not every connected component has direct authority over steering, braking, acceleration, or other safety-critical functions.
Cybersecurity Risk Still Exists
However, “not physically dangerous in this particular case” should not be interpreted as “not important.”
The compromised head unit is still an Internet-connected computing platform.
It can potentially be abused as part of a criminal network.
It can consume network bandwidth.
It can communicate with attacker-controlled infrastructure.
It can download additional malware.
And most importantly, the vulnerability demonstrates that automotive software infrastructure can become an attack surface.
From BadBox to the Dashboard
The MoYu Group Connection
Kaspersky researchers linked the campaign to the MoYu Group, a cybercrime operation previously associated with the notorious BadBox botnet.
BadBox became known for compromising Android-based consumer devices and using them as infrastructure for criminal activity, particularly advertising fraud.
The new campaign demonstrates how the same underlying criminal business model can move into new categories of connected hardware.
Cars Are Becoming Another IoT Platform
This is perhaps the most revealing aspect of the incident.
Attackers do not necessarily care whether a compromised device is a television, router, smartphone, set-top box, or car dashboard.
They care about whether the device can provide useful resources.
If a head unit has an Internet connection and sufficient privileges, it can potentially become another botnet node.
The Economics of Click Fraud
Click fraud is fundamentally an economic attack.
Automated systems generate fake advertising interactions that can produce fraudulent revenue or distort advertising metrics.
Criminal operators can scale these operations by controlling thousands or millions of compromised devices.
The individual infected head unit may be worth very little.
But thousands of compromised systems can become extremely valuable.
The Reverse Proxy Makes the Situation More Interesting
Turning a Car Into a Network Middleman
The researchers also observed a reverse-proxy module in the infection chain.
A compromised device operating as a proxy can potentially relay traffic through the victim’s network connection.
That creates a different type of risk.
Instead of simply generating fraudulent clicks, the compromised device may provide criminals with an additional Internet endpoint.
Why Proxies Matter to Cybercriminals
A distributed proxy infrastructure can make malicious traffic appear to originate from legitimate residential or consumer networks.
That can complicate attribution and allow attackers to conceal the true source of their activities.
In this context, the infected car is not merely participating in a botnet.
It can potentially become part of the
The Evolution of Botnet Distribution
Old Botnets Relied on Infected Applications
Historically, Android malware campaigns often relied on malicious applications.
Attackers would trick users into installing modified software, sideloading APKs, or downloading applications from unofficial stores.
That model still works.
But it has limitations.
Users can become suspicious.
Security software can detect malicious applications.
App stores can remove malicious packages.
Preinstalled Backdoors Changed the Equation
Another distribution method involved compromising devices before they reached consumers.
If malware is already present in firmware or factory-installed software, the attacker can bypass the traditional installation process.
But even that approach requires access to the manufacturing or software supply chain.
The Update System Is an Even More Powerful Weapon
The campaign described by Kaspersky represents another evolution.
Rather than relying exclusively on a malicious application or factory-installed backdoor, attackers abused the legitimate update process.
That is particularly concerning because software updates are expected to be trustworthy.
The attack therefore weaponizes the very mechanism designed to protect the device.
Deep Analysis: Why Automotive Update Systems Need Zero-Trust Security
The Update Mechanism Should Be Treated as Critical Infrastructure
Automotive update components should never be treated like ordinary Android applications.
They often possess permissions that allow them to modify the operating environment.
That makes them security boundaries.
Cryptographic Verification Must Come First
Every update package should be cryptographically signed.
The device should verify:
sha256sum update.apk
Administrators and manufacturers can use hashes as one layer of integrity verification, but hashes alone are not enough.
A stronger architecture verifies a trusted digital signature against an embedded or hardware-protected trust anchor.
Developers Should Inspect APK Signatures
For Android-based environments, defenders can examine package signatures using tools such as:
apksigner verify --verbose --print-certs update.apk
Unexpected certificates, signature changes, or unsigned packages should trigger investigation.
Examine Package Contents
Security teams can inspect an Android package with:
unzip -l suspicious.apk
The objective is not simply to determine whether an APK exists, but to understand what permissions, native libraries, services, and embedded resources it contains.
Search for Unexpected Privileged Components
A forensic workflow can include:
adb shell pm list packages
and:
adb shell dumpsys package
These commands can help investigators identify installed packages and examine their declared capabilities.
Monitor Update Activity
Defenders should establish what normal update behavior looks like.
For example:
adb logcat | grep -i update
Unexpected installation events, repeated updater launches, or unusual network connections around update activity deserve additional investigation.
Examine Network Connections
A compromised head unit may communicate with command-and-control infrastructure.
On systems where the necessary utilities are available:
adb shell netstat -tunap
or:
adb shell ss -tunap
can help reveal active connections.
Search for Suspicious Persistence
Investigators should also examine services and processes:
adb shell ps -A
Unexpected persistent services can provide important clues during forensic analysis.
Don’t Trust the Update Application
The central architectural lesson is simple.
A system component should not automatically be trusted simply because it was shipped by the manufacturer.
Every update should be authenticated.
Every package should be validated.
Every installation request should be authorized.
Every unexpected change should be observable.
Implement Least Privilege
The updater should have the minimum privileges required to perform its job.
If an updater can install arbitrary applications, execute arbitrary commands, or modify unrelated system components, its compromise becomes much more damaging.
Separate Update Infrastructure From General Applications
The update mechanism should ideally operate within a carefully isolated security boundary.
Its ability to interact with unrelated applications should be minimized.
Protect Cryptographic Keys
Signing keys are among the most valuable assets in an automotive software ecosystem.
If attackers obtain legitimate signing credentials, malware could potentially masquerade as legitimate software.
Keys should therefore be protected through hardened infrastructure and strict access controls.
Build Tamper Detection Into Firmware
A head unit should be capable of detecting unauthorized modifications.
Secure boot, verified boot, integrity measurements, and hardware-backed trust mechanisms can make persistent compromise significantly harder.
Make Rollback Possible
A vulnerable update mechanism becomes particularly dangerous when manufacturers cannot remotely or physically recover compromised systems.
Secure rollback and recovery procedures should be designed before an incident occurs.
Maintain Incident Response Procedures
Manufacturers should know exactly what happens when a malicious update is discovered.
Questions include:
Can the update system be disabled?
Can affected firmware be revoked?
Can devices receive emergency patches?
Can compromised certificates be rotated?
Can infected devices be identified remotely?
Can customers be notified?
These are operational security questions, not merely programming questions.
Monitor the Supply Chain
Automotive software increasingly depends on third-party components.
An OEM may not have written every application inside a head unit.
Therefore, security assessments must include suppliers, firmware vendors, update providers, and software libraries.
Treat Head Units Like IoT Gateways
The traditional view of a car dashboard as “just entertainment” is outdated.
An Internet-connected head unit is effectively a specialized computer.
Its security model should therefore resemble hardened IoT infrastructure rather than a simple consumer media player.
Segment Vehicle Networks
Where possible, infotainment networks should remain strongly isolated from safety-critical vehicle networks.
Network segmentation can limit the damage caused by a compromised entertainment component.
Limit Outbound Connectivity
A head unit that suddenly starts communicating with unfamiliar infrastructure should not be able to communicate without restriction.
Outbound network policies can reduce the value of a compromised device to a botnet operator.
Detect Botnet Behavior
Security monitoring should look for unusual traffic patterns.
Repeated connections to unfamiliar domains, high-volume outbound traffic, automated HTTP requests, and unexplained proxy activity can all indicate compromise.
The User Should Not Be the Main Security Boundary
The campaign highlights a major problem with traditional consumer security thinking.
If the attack abuses firmware functionality, telling users to “be careful what apps they install” does not solve the problem.
The manufacturer must secure the platform itself.
Updates Need Updates
Ironically, the mechanism responsible for updating vulnerable systems can itself become the vulnerability.
This creates a security paradox.
The component responsible for delivering protection can become the mechanism that delivers compromise.
Automotive Cybersecurity Is Becoming Software Security
The automotive industry increasingly depends on software.
That means automotive security teams need expertise in Android security, cloud infrastructure, firmware analysis, cryptography, network monitoring, supply-chain security, and incident response.
The Threat Will Not Stop at Infotainment
Today’s attackers may target infotainment systems because they are easy to monetize.
Tomorrow’s attackers may look for components with deeper privileges.
The security community should therefore treat this campaign as an early warning rather than an isolated curiosity.
Manufacturers Need Continuous Security Testing
Penetration testing should not stop when a vehicle leaves development.
Update mechanisms, firmware components, cloud services, and mobile applications should undergo continuous security assessment throughout the product lifecycle.
Security Must Follow the Vehicle
Cars can remain in service for many years.
A smartphone might be replaced after a few years.
A vehicle can remain operational for a decade or longer.
That creates a massive long-term security obligation for manufacturers.
Old Firmware Can Become a Permanent Liability
Even after a manufacturer fixes a vulnerability, thousands of vehicles may continue running older software.
A patch that exists but cannot reach deployed vehicles is not an effective defense.
The Automotive Industry Needs Better Recovery
Manufacturers need practical methods to identify, isolate, and remediate compromised head units.
Without recovery mechanisms, a device could remain part of a botnet indefinitely.
The Biggest Lesson Is Trust
The most important lesson from JarService is not that malware has entered cars.
It is that attackers found a way to abuse trust.
The update mechanism was trusted because it was supposed to install legitimate software.
That assumption became the
A Connected Vehicle Is a Computing Platform
The industry can no longer separate “car security” from “computer security.”
The two are increasingly connected.
Where there is software, there is an attack surface.
Where there is connectivity, there is an opportunity for remote abuse.
Where there is privileged software, there is something worth protecting.
The Future Will Demand Defense in Depth
No single technology will stop every automotive malware campaign.
Secure boot alone is not enough.
Application signing alone is not enough.
Network segmentation alone is not enough.
Monitoring alone is not enough.
The strongest defense combines all of them.
The Industry Should Act Before the Next Campaign
The current campaign appears focused on click fraud rather than physical vehicle control.
That should provide breathing room, not complacency.
Security researchers now have a real-world example showing that automotive update infrastructure can be weaponized.
Manufacturers have an opportunity to fix the architectural weaknesses before criminals discover more dangerous applications for the same techniques.
What Undercode Say: The Real Warning Is Bigger Than One Infected Car
1. A New Automotive Attack Surface
This discovery represents a significant change in the Android malware landscape because attackers are moving into a category of devices that many security teams may not monitor as aggressively as smartphones.
2. Cars Are Becoming IoT Devices
Modern vehicles increasingly behave like enormous IoT ecosystems, containing dozens or hundreds of software-controlled components.
3. Connectivity Creates Opportunity
An Internet connection transforms an isolated infotainment system into a remotely reachable computing platform.
4. Criminals Follow Monetization
The attackers do not need to steal the car if they can make money from the computer inside it.
5. Click Fraud Is Still Highly Profitable
Advertising fraud remains attractive because criminal groups can automate activity across huge numbers of compromised systems.
- The Update Mechanism Is the Most Important Detail
The most concerning element is not the clicker.
It is the abuse of trusted update functionality.
7. Trust Can Become a Vulnerability
A system that blindly trusts its updater creates an enormous security boundary.
8. Signed Updates Matter
Manufacturers need strong cryptographic verification for every software installation.
9. Privilege Makes the Problem Worse
An updater with elevated privileges can potentially turn a relatively small vulnerability into a complete system compromise.
10. Infotainment Should Not Be Ignored
Even if an infotainment module cannot control the vehicle, it remains a connected computer with valuable network access.
11. Botnets Are Becoming More Diverse
Criminal infrastructure is no longer limited to PCs and smartphones.
Routers, cameras, televisions, appliances, and now vehicle systems can all become potential botnet nodes.
12. BadBox Shows the Business Model
The connection to the MoYu Group demonstrates that established cybercrime operations can adapt their infrastructure to new hardware categories.
13. Vehicle Manufacturers Need IoT Security Expertise
Automotive engineering expertise alone is not sufficient for protecting complex connected software ecosystems.
14. Android Creates Familiar Risks
Because many head units use Android-derived environments, attackers can potentially reuse techniques already developed against the wider Android ecosystem.
15. Firmware Is Increasingly Important
Security teams need to inspect firmware, not just applications downloaded by consumers.
16. Supply Chains Matter
A manufacturer may rely on external vendors for the hardware, firmware, updater, or individual software components.
Every supplier introduces another potential attack surface.
17. Third-Party Components Need Security Reviews
The security of an automotive product is ultimately limited by its weakest trusted component.
18. Patching Must Be Practical
A manufacturer can discover and fix a vulnerability, but the real question is whether every deployed vehicle can actually receive the fix.
19. Long Vehicle Lifespans Increase Risk
Cars remain in use much longer than many consumer electronics products.
Security support therefore needs to last.
20. Remote Recovery Is Essential
Manufacturers should design emergency mechanisms for disabling compromised components and deploying remediation.
21. Network Segmentation Is Critical
An infotainment compromise should not automatically provide access to safety-critical systems.
22. Least Privilege Can Limit Damage
The fewer privileges an updater has, the less catastrophic its compromise becomes.
23. Outbound Traffic Deserves Attention
A compromised head unit may reveal itself through unusual communication patterns.
24. Detection Should Be Behavioral
Security teams should not depend exclusively on malware signatures.
They should also identify abnormal behavior.
25. Proxy Malware Creates Additional Risks
A compromised head unit may become a stepping stone for other criminal operations.
26. The Victim Can Become Infrastructure
This is one of the most important modern cybersecurity trends.
Attackers increasingly use compromised systems not just to attack the victim, but to attack others.
27. Cars Can Become Anonymous Network Nodes
If reverse-proxy functionality is deployed successfully, infected vehicles could potentially contribute to distributed criminal infrastructure.
28. Security Cannot Depend on Driver Awareness
The average driver cannot realistically inspect firmware or verify update certificates.
Platform security must therefore be built into the vehicle.
- Security Testing Needs to Continue After Launch
Automotive products should be continuously assessed throughout their operational lifespan.
30. Manufacturers Need Threat Intelligence
Threat intelligence can help companies recognize when familiar criminal groups begin targeting new device categories.
31. Researchers Should Continue Examining Firmware
Firmware analysis may reveal additional weaknesses before criminals discover them.
- The First Known Campaign Is Rarely the Last
Once attackers demonstrate that a particular attack path works, other groups may copy the technique.
33. Criminal Innovation Moves Quickly
Cybercriminals can reuse successful techniques across different hardware ecosystems.
34. Automotive Cybersecurity Is Now Mainstream Cybersecurity
The distinction between vehicle security and traditional cybersecurity is rapidly disappearing.
- The Industry Should Not Wait for a Safety-Critical Incident
The best time to improve automotive security is before an infotainment compromise evolves into something more serious.
36. Security Architecture Matters More Than Antivirus
Traditional malware detection is useful, but architectural protections can prevent entire categories of attacks.
37. Secure Boot Is Valuable
Ensuring that only trusted software executes provides an important foundation for firmware security.
38. Cryptographic Identity Is Essential
Every update should be able to prove that it came from an authorized source.
39. Visibility Is a Security Feature
Manufacturers need telemetry capable of identifying abnormal software installations and network behavior.
- The Dashboard Is Now Part of the Cyber Battlefield
JarService may ultimately be remembered less for the damage it caused than for what it demonstrated: the modern car has become another battlefield in the global fight against malware.
✅ Malware Targeted Android-Based Car Head Units
Kaspersky researchers documented an Android malware infection chain targeting automotive head-unit firmware. The discovery represents a genuine expansion of the Android threat landscape into vehicle infotainment systems.
✅ The Malware Abused a Legitimate Update Mechanism
The reported campaign exploited functionality associated with
✅ JarService Was Identified as a Multistage Downloader
The malware identified as JarService acted as a loader capable of downloading additional components. The campaign therefore involved more than a simple standalone malicious application.
✅ The Campaign Was Linked to the MoYu Group
Kaspersky attributed the activity with high confidence to the group associated with BadBox, based on infrastructure and technical overlaps observed during the investigation.
❌ There Is No Evidence Presented Here That the Malware Controlled Brakes or Steering
The affected DoFun head units were described as infotainment systems, and Kaspersky indicated that the observed infection did not create a physical safety risk to occupants. The incident should therefore not be portrayed as evidence that attackers remotely controlled the vehicle itself.
⚠️ The Wider Automotive Risk Remains Uncertain
Kaspersky reportedly did not establish whether other manufacturers have comparable weaknesses in their built-in update systems. That means the broader industry-wide impact remains an open security question rather than a confirmed universal vulnerability.
Prediction
(+1) Automotive Update Security Will Become a Major Research Area
As Android-based infotainment systems become more common, security researchers will likely spend more time examining firmware, update mechanisms, privileged services, and communication channels inside vehicles.
(+1) Manufacturers Will Strengthen Firmware Verification
Incidents such as this are likely to accelerate adoption of stronger cryptographic verification, secure boot, application allowlisting, and stricter updater permissions.
(+1) Automotive Botnets Could Become More Diverse
If connected vehicles prove economically useful to cybercriminals, additional criminal groups may attempt to recruit head units into proxy networks, advertising-fraud operations, or other distributed infrastructure.
(+1) Vehicle Security Will Move Toward Continuous Monitoring
Manufacturers will increasingly need telemetry and threat detection capable of identifying suspicious software installations and abnormal network behavior after vehicles have already reached customers.
(-1) Older Vehicles Could Become a Long-Term Security Problem
The biggest challenge may be legacy hardware. Vehicles that cannot receive modern security updates could remain vulnerable long after manufacturers understand the threat.
(-1) Attackers May Eventually Target More Privileged Automotive Components
Today’s campaign focused on infotainment functionality. Future attackers may search for systems with deeper access to vehicle networks, potentially increasing the consequences of a successful compromise.
(+1) The Biggest Lesson Will Be Simple: Never Blindly Trust the Updater
The JarService campaign demonstrates why update systems deserve the same security attention as operating systems themselves. When an attacker can manipulate the mechanism designed to install trusted software, the update process can transform from a defensive tool into an infection pipeline.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.darkreading.com
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
