New Malware Targets Android-Based Car Infotainment Systems

In June 2026, researchers discovered malware targeting Android-based car head units, specifically those using firmware from the Chinese company DoFun. This malware exploits a legitimate app, TWCore, responsible for software updates, to install a Trojan dropper called JarService without user interaction. The malware's primary goals include ad fraud and creating a proxy botnet from infected vehicles. The attack vector involves automatic firmware updates, making it a significant threat to connected vehicles. Currently, the malware is actively distributed, affecting millions of vehicles worldwide. Kaspersky has confirmed the incident and notified the vendor, which has since addressed the security issues. The malware operates silently, posing risks to drivers and vehicle security.

Key Points: • Malware targets Android-based head units in vehicles using DoFun firmware. • Infection occurs through a legitimate app (TWCore) used for firmware updates. • The malware aims to create a botnet for ad fraud, affecting millions of vehicles.