First Android malware targeting automotive head units | Securelist
Subscribe --><br>Dark mode off<br>Login -->
Securelist menu
EnglishRussian<br>Spanish<br>Brazil
Existing Customers
Personal
My Kaspersky<br>Renew your product<br>Update your product<br>Customer support
Business
KSOS portal<br>Kaspersky Business Hub<br>Technical Support<br>Knowledge Base<br>Renew License
Home
Products<br>Trials&Update<br>Resource Center
Business
Kaspersky Next<br>Small Business (1-50 employees)<br>Medium Business (51-999 employees)<br>Enterprise (1000+ employees)
Securelist<br>Threats
Financial threats<br>Mobile threats<br>Web threats<br>Secure environment (IoT)<br>Vulnerabilities and exploits<br>Spam and Phishing<br>Industrial threats
Categories
APT reports<br>Incidents<br>Research<br>Malware reports<br>Spam and phishing reports<br>Publications<br>Kaspersky Security Bulletin
Archive<br>All Tags<br>APT Logbook<br>Webinars<br>Statistics<br>Encyclopedia<br>Threats descriptions<br>KSB 2021
About Us
Company<br>Transparency<br>Corporate News<br>Press Center<br>Careers<br>Sponsorships<br>Policy Blog<br>Contacts
Partners
Find a Partner<br>Partner Program
Content menu<br>Close
Subscribe
Threat Response
Table of Contents
Head unit firmware overview<br>The TWCore app<br>Stage 1: the JarService dropper<br>Stage 2: the loader<br>Stage 3: clicker / reverse proxy loader<br>Attribution<br>Conclusion<br>Indicators of compromise<br>Stage 1: JarService<br>Stage 2: loader<br>Stage 3: loader/clicker<br>zhima module<br>Domains and IP addresses<br>Addresses used to download JarService<br>Hashes of TWCore (the legitimate software used to distribute JarService)
Authors
Dmitry Kalinin
While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further investigation confirmed that hypothesis and allowed us to reconstruct the entire infection chain.
Key findings:
We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet.
The malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.
We attribute this activity, with high confidence, to the MoYu Group, an actor linked to the BADBOX botnet.
Kaspersky solutions detect the threats described below under the following detection names:
HEUR:Trojan-Dropper.AndroidOS.Agent.vu
HEUR:Trojan-Downloader.AndroidOS.Agent.ov
HEUR:Trojan-Proxy.AndroidOS.Zhima.*
HEUR:Trojan.AndroidOS.Vo1d.*
Head unit firmware overview
A head unit is a system that combines multimedia functions with partial control over certain vehicle functions. Head units may come as part of a car’s factory equipment or as an aftermarket upgrade. The main attack vectors for these systems are compromise via physical access and vulnerabilities in the head unit’s OS or components, both of which we’ve covered previously.
In some cases, head units run on Android, primarily because it’s convenient for manufacturers: Android’s source code already accounts for use cases within automotive head units. Android also allows manufacturers to add their own system applications during the build process, which they can use for a range of purposes: customizing the UI, adding system components tailored to the vendor’s needs, and more.
Most apps developed for Android devices can also run on an Android-based head unit, and that is true for malware as well. That said, it’s hard to imagine certain categories of smartphone-targeted malware being used to attack a head unit. Banking Trojans are a good example: since mobile banking is used almost exclusively on smartphones, infecting a head unit with a banking Trojan would be a waste of the attacker’s resources.
It’s worth noting that head units often include SIM card slots and can connect to the internet, enabling features like navigation and software updates. Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using "classic" Android malware is infecting the device to recruit it into a botnet – similar to attacks on IoT devices.
During our research, we found exactly that kind of malware. The design of firmware for DoFun head units enabled attackers to distribute malware. We notified the vendor about the distribution scheme, and they subsequently reported fixing the security issues.
Below is the entire infection chain:
Head unit infection scheme
Let’s look at exactly how these head units became infected.
The TWCore app
TWCore is a legitimate system application responsible for collecting analytics data and updating the head unit software. Let’s take a closer look at how the update function works.
The process is fairly simple. An MQTT message broker hosted on the subdomain cardoor[.]cn sends...