A legitimate updater on Android-based car displays installed an invisible malware dropper without any action from the driver. Kaspersky researcher Dmitry Kalinin traced the chain from the TWCore system app on DoFun-powered head units to ad-fraud code and a residential-proxy module that puts the vehicle’s internet connection to work for strangers.
The affected surface is specific. Kaspersky says the campaign targeted head units using DoFun software; it did not establish that Android Automotive, every aftermarket Android display, or vehicle safety systems were compromised. DoFun claims its software serves more than 30 million vehicle owners, but Kaspersky did not quantify infected head units, models, countries, or drivers.
Kaspersky calls it “the first documented case of malware being delivered to automotive head units via an automatic firmware-update service.” The company discovered the activity in June 2026 and published its findings on August 21. It is vendor research evaluating malware its own products detect, with no sponsored placement disclosed.
The updater installs a dropper
TWCore is a legitimate system application that collects analytics and updates software on DoFun head units. Under normal operation, it asks the developer’s cloud which APKs should be installed or refreshed. The same mechanism can add an application that was never present on the device.
Attackers used that authority to deliver JarService. The app has no interface and does not need to fool a driver into approving an installation. Kaspersky says its telemetry associated the observed installations with TWCore, turning the updater’s existing privilege and trusted position into the delivery mechanism.
That distinction defines the recognition problem. Finding com.tw.core or a software update on its own does not establish compromise. The stronger signal is a vendor updater installing an unexpected app such as JarService, followed by encrypted in-memory loading and outbound requests that are unrelated to an approved firmware release.
Kaspersky says it notified DoFun and the vendor reported fixing the security issues. Neither company published an affected-version range, a fixed firmware build, a release identifier, or a supersession chain. Defenders therefore have no specific fixed version to cite and must obtain the supported clean image or updater release for each head-unit model directly from DoFun or the vehicle supplier.
Three stages build the proxy
JarService is the first malware stage. It decrypts an embedded second-stage downloader and invokes its entry point. The downloader then sends implant information to attacker infrastructure, receives the location of another payload, retrieves it, decrypts it, and runs it.
Figure details
The linear chain begins with the legitimate TWCore updater installing the previously absent JarService app. JarService decrypts a downloader, which contacts command infrastructure and retrieves the final stage. The final stage supports ad-click activity and loads the zhima residential-proxy module. A boundary note separates DoFun's reported updater fix from the unpublished fixed build and the unquantified infection count.
The final stage reports the device model, display resolution, connected Wi-Fi identifier, MAC address, and other host data. It can make web requests, open pages, and download and execute additional code. Kaspersky says the operators used those capabilities for fraudulent advertising activity and to install a module called zhima.
The evidence distinguishes delivery from execution. TWCore installed JarService; JarService decrypted the downloader; the downloader fetched the later payload; and Kaspersky observed the clicker and proxy outcome. A staged APK or network request alone is weaker than package installation, class loading, or proxy-relay traffic on the same head unit.
MoYu Runs Proxies Through Cars
Kaspersky attributes the activity to MoYu Group with high confidence. Its assessment rests on meaningful names in the malware, overlap with infrastructure attributed to MoYu, and links to the wider BADBOX ecosystem. Attribution does not change the immediate response: the compromised asset is an infotainment endpoint whose network identity and bandwidth can be resold.
Nokia Deepfield’s independent analysis of zhima shows what that outcome looks like in an adjacent MoYu Android delivery chain. The class com.miyc.transfer.Client makes an infected device dial an operator relay. The proxy customer talks to that relay, while the device opens the onward connection and shuttles traffic. A perimeter scan will not find a new listener because the control and data paths are outbound.
Nokia observed TCP port 9999 for registration and control, 7777 for bulk proxy traffic, and 5555 for heavier per-job sessions. Its report lists the relay 165.154.202[.]29 and module loader 144.217.243[.]201; it also documents a1 and t1 subdomains under ishano456[.]sbs, xmsae[.]sbs, and xshaon123[.]sbs. These are attacker-controlled indicators and are defanged here. The complete malware acquisition paths remain text-only to avoid making the payload easier to obtain.
The two reports cover related activity with different delivery vehicles. Kaspersky observed the DoFun head-unit chain. Nokia analyzed zhima delivered through grey-market Android TV applications and explicitly left one loader continuation unresolved. Their overlap corroborates the proxy module and MoYu infrastructure; it does not prove a shared infection count or make every Android device that contacts a content host malicious.
Verify the updater’s trust chain
Inventory Android-based head units that use DoFun firmware or TWCore. Record the vehicle or display model, firmware identifier, updater version, APK signing certificates, installed package list, installation timestamps, and the network path used for updates. Preserve com.tw.core, JarService references, com.miyc.transfer.Client, and unexpected application installs as separate facts so a downloaded artifact is not mistaken for an executed one.
Hunt egress from infotainment VLANs and cellular gateways for the defanged IP addresses, the a1 and t1 host patterns, and unusual long-lived outbound sessions on TCP 9999, 7777, or 5555. Treat a domain or port match as a lead. Raise confidence when the same device shows an unapproved APK installation, dynamic class loading, a new application without a launcher activity, or sustained relay traffic.
Run the verification test on one representative head unit for every model and firmware combination. Reimage it from the supplier-approved source, apply the current supported updater, capture its package inventory and signing certificates, and observe a complete update cycle in an isolated network. The test passes when TWCore installs only the approved, signed package set; JarService and com.miyc.transfer.Client are absent; and no traffic reaches the published MoYu indicators or proxy-relay ports.
A clean test image does not attest to the history of a deployed unit. Preserve telemetry and compare it with the known-good result before returning an exposed head unit to service. Where a supplier cannot name the fixed build or prove the update channel’s provenance, isolation from trusted vehicle, corporate, and home networks is the measurable control available to the defender.