A new malware directed at Android-based multimedia car systems has been detected. The alert is from Kaspersky and shows that cars can also be targeted by cyber criminals.
© Shutterstock
31/08/2026
by
O cybercrime can also target cars. This shows a new malware campaign that affects Android-based multimedia systems that equip multi-brand cars – taking advantage of their vulnerabilities and internet access.
This is what Kaspersky’s computer security expert, who explained in a statement what is at stake: “The threat exploits legitimate software update mechanisms to infect devices discreetly“.
If you install this update, criminals can practice “advertising fraud, collecting device information and downloading malicious modules“.
The same company says that “the main attack vectors in these ecosystems include unauthorized physical access and exploitation of vulnerabilities in the operating system or in specific modules of the plant”.
Talks about “first documented case of infection of a car multimedia system through a specifically designed chain of infection for these systems”.
Attackers may be linked to the MoYu group, “a threat agent closely linked to the known BadBox botnet,” Kaspersky explains. BadBox is “a large-scale network consisting of committed Android devices [...] that reach users already infected with factory malware”.
Watch out for accessories apart
In addition to source systems, there is the possibility to equip a car with accessories apart for sale either in physical stores or online. This is particularly relevant in Portugal, according to Kaspersky, for the ageing of the car park.
It turns out these devices are more susceptible, since updates are not under direct control of car brands.
It should be noted that the multimedia (or info-entertainment) systems of origin in cars usually combine car settings, navigation, multimedia playback, smartphone connectivity and even car control functions. They are usually permanently connected to the Internet – that is, even though it may seem so, the automotive environment is not watertight.
In many models, the Android-based system has conventional applications, with the same vulnerabilities and susceptibility as those that can be installed on any other device. However, car systems rarely store sensitive personal information.
How did the infection work?
In the same note, it can be read that the malware in question was distributed on updates of the systems developed by DoFun, which has already been notified by Kaspersky about the problem and made sure that he had corrected the situation.
The origin of the infection chain is a legitimate application (TWCore), which collects analytical data and takes care of updating the system. To this end, “I received instructions from the manufacturer’s server indicating which applications should be installed or updated on the systems”.
This is the way attackers used to distribute a previously unknown malware (JarService), in a multi-stage infection process to go unnoticed. It started with a normal application without user interface, running in the background.
“Nine distinct commands” were implemented, with the ability to “present unwanted ads, execute advertising fraud, and download additional malicious modules”.
More: cybercriminals could also consult sensitive information as the device model and even network identifications to which the multimedia system was connected.
In the end, invisible to car users, resources (such as mobile data) were used and fraudulent clicks were generated in ads. All of this was on the “backdrop” of the multimedia screen of the car.
Criminal activity continues
Dmitry Kalinin, Kaspersky security investigator, warned: “Despite the efforts of cybersecurity experts and police authorities to close the BadBox botnet, individuals associated with it continue their malicious activities, infecting devices worldwide“.