The malware didn’t sneak onto these DoFun head units. The units’ own updater installed it. Kaspersky found the infection in June 2026, and the program that installed the dropper is a system app called TWCore, which handles analytics and software updates, according to Kaspersky’s published report.
Kaspersky released the findings on August 21, 2026, and calls it the first documented malware with an infection chain built for car head units, per its press release. Researcher Dmitry Kalinin walks through the discovery in the video below.
Video: Kaspersky researcher Dmitry Kalinin explains the findings.
A head unit that installs software whenever a server tells it to has made that server connection its entire security perimeter. Here, somebody else ended up holding the other end.
The updater did exactly what it was built to do
Kaspersky says TWCore takes its instructions from an MQTT broker, a lightweight messaging service, run on a server tied to the cardoor.cn domain. One setting in those instructions, a Boolean called installNotExists, lets TWCore install apps that are not already on the device. When the setting is false, TWCore checks whether the app is installed first. Downloaded APK files landed in a push/apk folder inside TWCore’s external cache directory, and Kaspersky’s telemetry showed the malware installed by TWCore each time.
Remote installs are an ordinary feature on a head unit, which has to take map, analytics and vendor app updates after it leaves the factory. They also mean that whoever controls the instructions controls what runs on the screen in the dash. The report summaries I reviewed do not say whether the vendor’s own infrastructure was compromised or the channel was misused by someone with legitimate access, so that part is unconfirmed.
A silent dropper that phones home every 90 minutes
The first stage, a dropper Kaspersky calls JarService, has no user interface. That is how Kaspersky noticed it: an app that installed like a normal one but never showed anything suggested it was arriving without the owner doing anything. Stage two decrypts and loads stage three, which checks in with its command server every 90 minutes by default and reports the display resolution, model, Wi-Fi network name and MAC address. The Auto Wire’s read is that the network name is the field worth worrying about, since Wi-Fi names are a common way to place a device on a map.
The malware has nine commands, according to Kaspersky, and the attackers were using two. One of them downloads and runs code from the server. The code it fetched was a reverse-proxy module named zhima. Other commands open web pages or run JavaScript inside the unit, which Kaspersky says points to ad display and click fraud.
What a reverse proxy does with a car’s connection
A reverse-proxy module lets outsiders route their own internet traffic through the infected device, so that traffic appears to originate from the device’s connection. In a head unit that connection may be a phone hotspot, a home network or a built-in SIM, and the owner pays for the data either way. The FBI described the business model in a June 5, 2025 public service announcement: criminals sell or give away access to compromised home networks through residential proxy services, which are then used for other crimes.
Kaspersky attributes the activity to a group called MoYu, which it links to the BADBOX botnet with high confidence. It cites a thread name, a set-top-box app and shared infrastructure, and says Nokia Deepfield’s emergency response team separately found the same zhima module on TV set-top boxes.
The FBI already had aftermarket infotainment on its list
The FBI’s BADBOX 2.0 notice names aftermarket vehicle infotainment systems alongside streaming boxes, projectors and picture frames, and says most infected devices were made in China. It describes two routes: devices configured with malicious software before the buyer opens the box, and devices that pull in backdoored apps during setup. The DoFun case is a third route, an update channel used after the sale, and Kaspersky’s write-up does not describe it as pre-installed.
Scale is unknown. Kaspersky names only DoFun, says several of its Android-based models were affected, and gives no victim count or country breakdown. It says it notified the vendor and the vendor reported fixing the issues. What I did not find is how that fix reaches a unit already bolted into a dashboard, and that is the question for any owner with one.
What owners of unbranded units can do now
Kaspersky did not publish consumer guidance. The FBI wrote its advice for home devices, and in a dashboard most of it runs out fast. Few owners can watch a head unit’s network traffic, and “keep firmware current” only works if the vendor ships firmware. What’s left is the blunt option: if a no-name unit starts acting on its own, disconnect it. Anyone who believes they were affected can file at ic3.gov. A factory screen has a manufacturer whose name is on the window sticker, and even that is no guarantee, as The Auto Wire reported on the BYD Shark 6 hack and on what GM driving data did after it left the car. A no-name unit ordered online comes with no one to call.
Two things to watch: whether Kaspersky’s indicators of compromise or Nokia Deepfield’s findings turn up the same updater on other brands, and whether DoFun’s fix is pushed to cars already on the road.
What did your aftermarket head unit cost, and who would you call if it started installing apps on its own?