AppWizard
August 21, 2026
A new strain of Android malware has emerged, targeting automotive head units responsible for infotainment, connectivity, and navigation in vehicles. Discovered by Kaspersky in June, this is the first documented instance of malware affecting car head units, specifically within the firmware updaters of Android-based software developed by DoFun, a Hong Kong company. The malware, disguised as an application called JarService, infiltrates devices without user awareness. It is delivered through a legitimate system application called TWCore, which collects analytics and updates software. The malware aims to convert the head unit into a botnet, equipped with commands to download and execute code and display advertisements, potentially for online ad fraud. Kaspersky notified DoFun, which addressed the vulnerabilities, and noted similarities between this malware and a previous threat called BadBox, which affected various Android devices.
