Infected Car Screens Phoned Home Every 90 Minutes, Antivirus Firm Kaspersky Says

Kaspersky's August 21, 2026 report says the malware reached DoFun Android head units through their built-in updater and ended in ad fraud and a reverse proxy. The vendor reported a fix.

A three-stage Android malware chain reached car dashboards through the head unit's own update system, and ended in a proxy botnet, security researchers say. The chain was described on August 21, 2026 by the antivirus maker Kaspersky, in a technical report on its Securelist research blog. Kaspersky does not say how many head units were infected, or in which countries.

This lands on the aftermarket screen bolted into a dashboard: the unit that arrived with its own updater and no visible way to see what that updater installs. Kaspersky says the app it found in June 2026 had no icon and no user interface at all, which is what made it look wrong in the first place.

The updater was the delivery route

The design of the firmware for DoFun head units, an Android-based infotainment system, allowed attackers to distribute the malware, Kaspersky says. The company points to TWCore, a legitimate system app on those units that collects analytics and installs software updates. A message broker hosted on a subdomain of cardoor[.]cn tells TWCore which package files to download and install, per the report.

One field in that message does the damage, Kaspersky says: a boolean flag called installNotExists. When it is set to true, TWCore skips the check for whether an app already exists on the device and installs it anyway. Kaspersky says it notified the vendor and the vendor subsequently reported fixing the security issues. The report does not say the researchers verified the fix, and it does not name a fixed firmware version.

Ad fraud first, proxy second

The first stage is a dropper Kaspersky calls JarService. The second is a loader that posts implant details to a command server and receives a download link for the third. The third stage is the working part: it sends a POST request every 90 minutes by default, carrying the display resolution, the device model, the MAC address and the SSID of the connected Wi-Fi network, according to the report.

Nine commands were implemented at the time of the research, Kaspersky says, including opening links in a hidden web view and running arbitrary JavaScript. In observed attacks, only two were in use. One of them downloads a reverse proxy module named zhima — the same module researchers at the Nokia Deepfield Emergency Response Team independently found in TV set-top boxes, per Kaspersky's report.

The report describes no theft of contacts, call logs or paired-phone data. Kaspersky's stated view is that a head unit holds little of value to an attacker, so the value is the connection itself: ad fraud and a residential-looking proxy node that happens to be parked in a car.

Who Kaspersky blames

Kaspersky attributes the activity with high confidence to the MoYu Group, an actor it links to the BADBOX botnet described by researchers at HUMAN. The report rests that call on a loader thread named mosdk-host-loader, a related app found on TV set-top boxes with a service named AdmoyuService, and overlapping network infrastructure. It calls the case "the first known malicious app targeting head units."

What an owner can check

Not much, honestly, and the report is the reason why. Kaspersky publishes an indicator list — MD5 hashes for each stage and for eight zhima variants, plus domains including kookjar[.]com and the IP addresses 144.217.243[.]201, 107.151.248[.]132 and 128.14.210[.]58. It also lists three addresses used to download the dropper, sitting in upgrade directories dated 2024-11-07, 2025-06-10 and 2026-06-08.

For a driver, that translates to two checkable things: the installed-app list on the unit, where the malicious package identified itself as JarService, and the vendor's own firmware update notes. Kaspersky's detection names for the family are published in the report.

Source: securelist.com, retrieved August 23, 2026.