Hackers Turn Car Infotainment Screens Into a Botnet in First Attack Built for Vehicles

A Poisoned Update Channel

The campaign targets head units running software from DoFun, a Chinese automotive software provider that says it serves more than 30 million vehicle owners. Attackers hijacked TWCore, the legitimate system app that updates DoFun head units, and used it to push a hidden malware dropper called JarService directly onto devices.

The malware installs like an ordinary app but has no interface at all, running unnoticed in the background. It then downloads encrypted payloads that report device details and await commands, including one that loads a reverse-proxy module named "zhima," turning the car's screen into a node in a for-rent proxy network.

Who Is Behind It

Kaspersky attributes the operation to the MoYu Group, a threat actor tied to BadBox, the notorious botnet built from cheap infected Android TV boxes and tablets. Cars appear to be the botnet's newest frontier.

There is one reassurance: the malware does not touch driving or critical vehicle controls, researchers say. Its goal is money, not mayhem — click fraud and selling access to the hijacked internet connections. Kaspersky notified DoFun, and the company says the problem has been resolved.

What Comes Next

The precedent matters more than this single campaign. Head units are internet-connected computers that owners rarely think of as hackable, and update channels reach millions of them at once. Researchers have not yet said how DoFun's update pipeline was compromised, an answer that will determine whether other automotive software vendors face the same exposure.