Android Car Head Units Hit by Silent Malware via Legitimate Update Channel

Kaspersky researchers have identified a supply chain attack targeting DoFun Android car head units, in which malware is silently installed through the device's legitimate software update system, TWCore. Attackers inject commands via an MQTT broker to download a malicious APK called JarService into the device's cache without any user interaction. Once installed, JarService executes a multi-stage payload that ultimately loads the zhima reverse proxy module, turning the head unit into a relay node for external traffic and ad click fraud. The malware reports device details to a command-and-control server every 90 minutes and awaits further instructions, while showing no visible interface on the car display. Kaspersky found no evidence of interference with driving functions, but noted that such devices typically fall outside enterprise security monitoring tools, making detection difficult.