Kaspersky: JarService malware builds proxy botnet from Android car head units

Malware arrived through the unit's own updater

A Kaspersky Securelist report published on 21 August 2026, "The invisible passenger in your car", describes a supply-chain attack on Android car head units built around software from DoFun. The units ship with a legitimate system app, TWCore (com.tw.core), that receives update instructions over MQTT from a broker at cardoor[.]cn. One of its options, installNotExists, authorizes the app to install packages that are not yet present on the device.

According to Kaspersky, the attackers abused exactly that mechanism. They pushed instructions through the update channel that made TWCore download and install a malicious APK, JarService, into its own external cache. The process was fully automatic: no tap on the screen, no confirmation dialog, no driver action of any kind.

A silent multi-stage implant

JarService has no user interface, so nothing visible appears on the dashboard. On launch it decrypts an XOR-encoded internal block and starts a Stage 2 loader. Stage 2 registers the implant with its command-and-control server via an HTTP POST and downloads an encrypted Stage 3 payload from a URL supplied in the response.

Stage 3 is the resident component. By default every 90 minutes it reports the device model, screen resolution, the SSID of any connected Wi-Fi network and the MAC address to the C2 — visible as periodic POSTs to /cpc/api/task — and retrieves fresh configuration and commands. Kaspersky's indicators also list the detection HEUR:Trojan-Downloader.AndroidOS.Agent.ov for the campaign.

Notably, the implant needed no elevated privileges. Kaspersky notes JarService ran as an ordinary user application, with no root access or privilege escalation involved.

Ad clicks and proxy bandwidth

Two commands were observed in active use. The http command directs the unit to visit specified URLs, generating traffic for ad click fraud. The loadlib2 command downloads and executes arbitrary modules, and with it the operators deployed zhima, a reverse proxy that turns the infected head unit into a relay node, pushing third-party traffic through the vehicle's cellular or Wi-Fi IP address.

Kaspersky states it has not observed any interference with driving operations or critical vehicle controls; the monetization is confined to advertising fraud and proxying.

How the update path was breached is unclear

Kaspersky says the attackers were positioned to inject malicious APK distribution instructions into DoFun's legitimate update channel, but the method used to compromise that infrastructure has not been made public. DoFun reported to Kaspersky that the issue has since been resolved.

The report lists the MoYu Group and BADBOX among related entities, and related coverage includes an analysis of MoYu's zhima proxy running on a smart TV — suggesting the same proxy module is being recycled across device categories.

What defenders can watch for

Car head units generally sit outside enterprise EDR coverage, so network telemetry is the realistic detection surface. Kaspersky's indicators include MQTT and APK download traffic to cardoor[.]cn; DNS and HTTP contact with kshahnd[.]sbs, mdsjhd[.]sbs, nmnsny[.]sbs and kookjar[.]com; Stage 3 and zhima downloads from 144.217.243[.]201; and zhima-related traffic to 107.151.248[.]132 or 128.14.210[.]58. On the device itself, unknown APKs under TWCore's push/apk cache directory — with com.tw.core recorded as the installer — and packages such as com.tw.jar1 are the tell-tale artifacts. Blocking C2 and zhima communication at the perimeter, or catching the unknown APK before the loaders run, are listed as conditions that break the chain.

Why it matters

This campaign moves the Android proxy-botnet problem, previously seen on smart TVs and cheap streaming boxes, onto vehicles — a device class with an always-connected cellular link, a mobile IP address that proxy operators value, and almost no endpoint monitoring. It also shows how dangerous an overly permissive update path can be: a single installNotExists flag turned a maintenance feature into a malware distribution channel. The observed payload was commercially motivated and did not touch vehicle control functions, but an implant with an arbitrary-module loader running on infotainment hardware is a capability, not just a nuisance. For fleets, cars connecting to corporate Wi-Fi or sharing telematics plans may now need to be treated as networked endpoints in their own right.