Car screens were infected through their own update channel.

What happened, in one sentence

Kaspersky documented in June 2026, through researcher Dmitry Kalinin, the first known malware campaign with an infection chain built specifically for car head units. It did not arrive through a pirated app or a USB stick: it came through the device's own official update mechanism.

The infection chain, step by step

It is worth seeing broken out, because every link is a design decision by the attacker:

• 1. The entry point is a legitimate system app. TWCore (com.tw.core) ships on Android head units built on the DoFun platform and handles analytics and software updates. It is not malware: it is the component meant to keep the device current.
• 2. The delivery channel is MQTT. Update instructions travelled over an MQTT broker hosted at cardoor[.]cn. MQTT is a protocol built for connected devices, light and quiet, which is exactly why this class of hardware uses it.
• 3. The payload arrives as an APK. That channel served a package carrying a component called JarService.
• 4. It installs like an ordinary app, but with no face. No interface, no icon, no permissions requested under a pretext and no attempt to impersonate anything.

That fourth point is the telling one. Almost all Android malware disguises itself: it imitates a torch, a media player, a banking app. This one did not bother. And that is precisely how researchers knew nobody had installed it by hand: something that makes no attempt to fool a user was never relying on one.

What an update channel should do, and what this one did

• Should: deliver software signed by the manufacturer. Did: hand over someone else's APK with the same trust.
• Should: be verifiable by whoever receives it. Did: install with the owner seeing nothing.
• Should: reduce the device's risk. Did: become the only way in that was needed.

This is what lifts the case above an oddity: an update channel is a trust channel, and whoever controls it does not need to deceive anybody.

What it does once inside

It sits in the background and calls its command-and-control server every 90 minutes. It supports nine distinct commands which, per the research, fall into four capabilities:

• Unwanted advertising. Ads where there were none.
• Ad fraud. Simulated clicks and views that somebody gets paid for.
• Downloading further modules. The part worth not skipping.
• Device reconnaissance. Learning what it is and what surrounds it.

"Downloading further modules" means day-one functionality is not the ceiling. What is installed is a door; what comes through it is decided later and can change without the device ever being reinfected.

Other outlets covering the case also describe reverse proxy functionality, and report that Nokia's Deepfield team found the same family on TV set-top boxes. That is not in the primary source, so it sits here as what it is: reported elsewhere.

Why anyone wants your screen as a way out to the internet

This is the part almost nobody explains, and the one that actually affects the owner.

When a device of yours acts as somebody else's exit, their traffic leaves carrying your IP address. Anyone looking from outside, a website, a bank, a platform, sees your connection rather than theirs.

And here is the business, simpler than it looks:

• A data-centre IP draws suspicion instantly. Anti-fraud systems know them and block them.
• A residential one, or one belonging to a car parked on an ordinary street, looks like an ordinary person.
• So the second gets rented out and the first is worth nothing.

The value is not your screen or your data: it is that your connection looks credible. You are the alibi, not the target.

Who it affects, and what the source does not say

The research points at Android head units built on the DoFun platform, the base for many aftermarket units: bought separately, fitted into the radio slot, almost always well below carmaker prices.

And it is worth stating plainly what the report does not publish, because it is exactly what anyone would want to know:

• No specific makes or models.
• No number of infected devices.
• No list of affected countries.

On attribution: Kaspersky assigns it with high confidence to the MoYu Group, previously linked to the BADBOX ecosystem. "High confidence" is a researcher's judgement backed by solid indicators, not a verdict, and attribution indicators are forgeable.

Warning signs

None is conclusive on its own, and that is part of the problem. But if several show up together, it is worth asking:

• Advertising where there was none before. The most visible symptom the report describes.
• Data usage that does not add up, if the unit carries its own SIM.
• Unexplained sluggishness, particularly at start-up.
• Apps you do not recognise that will not uninstall.

What you can do

• Ask about updated firmware from the head unit maker or the shop that fitted it. Per the source, the issue was addressed after responsible disclosure.
• Do not give it accounts it does not need. If it will not use your email, your Google account or your cloud storage, keep them off it.
• Watch the data bill if it has a SIM. A device acting as a proxy consumes data, and that shows.
• If you are buying a head unit, ask who publishes the updates and how often. It is an odd question in a shop, and that is exactly why it separates a serious manufacturer from the rest.

What this one leaves behind

Two things, and the second is the uncomfortable one.

First: an update channel is a trust channel. It is the lesson of every supply-chain attack, applied this time somewhere nobody looks.

Second: there is an entire category of devices, car screens, set-top boxes, televisions, digital photo frames, cheap cameras, that sell for very little, join your network, update themselves from servers you have never heard of, and are audited by nobody. They carry no antivirus, they raise no alerts, and you never inspect them. This case is not an industry oddity: it is the first one somebody took the trouble to document properly.

For why a "residential" IP carries a price, the background is in how networks work; for what traces an intrusion leaves, see indicators of compromise.

Source: Kaspersky research →

Frequently asked questions