Skip to content
Malware Infects Android Head Units via Updater, Kaspersky Reports

Malware Infects Android Head Units via Updater, Kaspersky Reports

First seen 27 Oct 2026, 20:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 03:19 UTC
  • •Malware installed via the TWCore updater on DoFun Android head units.
  • •Infection discovered in June 2026, with findings released in August 2026.
  • •Malware operates silently, reporting device data to a command server every 90 minutes.

Kaspersky identified malware in DoFun Android head units, installed through the TWCore updater, which handles software updates and analytics. The infection was discovered in June 2026, with findings published on August 21, 2026. The malware, referred to as JarService, operates without a user interface and checks in with its command server every 90 minutes, collecting device information. The infection chain is notable as it is the first documented case of malware specifically targeting car head units. The attack vector leverages a setting in TWCore that allows installation of apps not previously on the device. Kaspersky has not confirmed whether the vendor's infrastructure was compromised or if the channel was misused by someone with legitimate access. The malware can execute commands, including downloading code and potentially facilitating ad fraud.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-01
Malware infection discovered
Kaspersky identified malware in DoFun Android head units, installed via the TWCore updater.
Autos.Yahoo
2026-08-21
Kaspersky publishes findings
Kaspersky released a report detailing the malware infection chain affecting car head units.
Autos.Yahoo

More articles in this cluster (4)

Following this threat?

Track MoYu and DoFun in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which devices are affected?
The malware specifically targets DoFun Android head units utilizing the TWCore updater.
How does the malware operate?
The malware operates silently, installing without user interaction and reporting device data to a command server.
What should users do to protect their devices?
Users should monitor for updates from their device manufacturers and consider disabling remote updates if possible.