Smart car displays are no longer just for navigation or music. They've become a potential entry point for cybercriminals. Kaspersky has investigated an Android malware campaign targeting these systems by exploiting a legitimate update, making it the first documented case of malicious code specifically designed to attack a vehicle's systems. The threat isn't used to directly steal bank accounts, but rather to profit from advertising fraud and extract information from the car.
The source of the malware has been traced back to the channel used by devices for updates. Kaspersky researchers explain that the malware spread through the update system of some Android displays from the vendor DoFun, installing itself in the background without the user noticing. Although these systems rarely store sensitive personal data, they are connected to the internet and have a SIM card slot, making them an attractive target for attackers.
The thread of the infection: a compromised update
Instead of using a pirate website, the cybercriminals manipulated a legitimate system application called TWCore. This tool is responsible for collecting analytics and managing device updates. By gaining control of it, they were able to deliver a hidden installer called JarService. This program runs without a user interface, so the driver doesn't notice anything unusual, and the malware operates entirely in the background.
Once installed, the malware has up to nine different commands to display unwanted ads, carry out large-scale ad fraud, and download additional malicious modules. It also collects technical information about the vehicle, such as the model, screen resolution, connected Wi-Fi network, and physical hardware address. This data can be used to strengthen control of the device or sent to the attackers' servers.
Kaspersky's analysis reveals that the infrastructure of this campaign shares dashboards and code snippets with the BadBox network, a vast network of infected Android devices used to divert unauthorized traffic and steal data. It is also linked to the MoYu Group, a cyber threat actor that has already appeared in global operations related to this type of malware. The connection is not coincidental, but rather points to a highly organized operation.
DoFun has already fixed the vulnerability
The manufacturer DoFun has confirmed that it has fixed the vulnerability after being notified by Kaspersky. The fix blocks the update route used by the attackers, but the security company warns that the method demonstrates the extent to which cybercriminals are evolving. Leveraging an official software component, rather than building a fake one, is a further step in the sophistication of these threats.
Dmitry Kalinin, a security researcher at Kaspersky, has pointed out that malicious actors are exploring new platforms. This malicious code, he says, is the first example of malware specifically designed to infect car screens through a chain attack. The warning is clear for the automotive industry: infotainment systems need robust protection and privacy settings against malware.
The research also highlights that vehicle multimedia screens, while not storing confidential data, are permanently connected to the internet. This connectivity, along with the SIM card slot, makes them another point of entry into the vehicle's digital ecosystem. Attackers can exploit this to carry out other actions, such as diverting traffic or accessing the vehicle's remote functions.
Kaspersky's discovery comes at a time when connected driving is widespread in Europe. Modern cars rely on these devices for navigation, calls, and multimedia, opening the door to more entry points for cyberattacks. This case reinforces the idea that Android security solutions shouldn't be limited to mobile devices but should also extend to the embedded systems used in cars. Protecting smart displays is now an urgent issue that cannot be ignored.
