Someone is using your car’s internet connection. Not your phone or your router, but the touchscreen in your dashboard.
Kaspersky released research on August 21 about the first malware made to infect car head units. It didn’t come from a suspicious APK or a USB stick. Instead, it arrived through the same channel as firmware updates, approved by the head unit’s update service, so the driver never noticed anything.
The goal here isn’t to steal your data. Instead, it’s about ad fraud and turning your car into part of a residential proxy botnet. Your car is now a node in this network. Nothing gets harvested, nothing ends up in a stolen identity listing — the value is the connection itself.
How researcher Dmitry Kalinin found it
He wasn’t looking at cars. He was monitoring Android threats in June 2026 and kept seeing an app that behaved wrong.
Most malware tries to look like something else, like a fake Flash update, a ‘System Service,’ or a copied banking app. There’s always some disguise. But this one had no user interface and didn’t try to look real at all. That’s unusual if you want someone to tap ‘install.’
The theory was that nobody needed to tap anything, and that turned out to be true.
The update service was the delivery mechanism
DoFun head units ship with a system app called TWCore. It handles analytics and software updates. Completely legitimate, installed at the factory, exactly what you’d want on a device that needs to patch itself.
TWCore listens to an MQTT broker on a subdomain of cardoor[.]cn. The broker tells it which APKs to fetch and install. Fine so far.
The issue is a setting in the message format called installNotExists. If it’s set to false, TWCore checks if the app is already on the device before doing anything. If it’s true, it skips that check and installs whatever it was told to, even if the software was never on the head unit before.
That’s the entire method. There was no exploit, no CVE, and no privilege escalation. Just a push-install flag aimed at a system app with system-level rights. Kaspersky has looked at head unit security before, but those cases needed physical access or a bug in the OS. This one needed neither.
Kaspersky told DoFun. The vendor says it’s fixed.
Three stages, and the third one is a rental unit
Stage one is JarService, a dropper with no interface. It holds the next stage as encrypted blocks within its own code, using a one-byte key that changes slightly between blocks. It’s simple obfuscation, but enough to fool a basic scanner.
Stage two is a loader that sends a small JSON file with device details and receives a download link in return. Kalinin saw that the URL had a version number, so he tried different numbers and found seven different payload versions. Version 3.57 uses a completely different decoding method, which suggests earlier versions used a different loader.
Details like version numbers in payload URLs are very helpful for researchers.
Stage three is where things get interesting. Every 90 minutes, it sends device details like screen resolution, model, MAC address, and the SSID of the car’s Wi-Fi. It can handle nine commands, including one that opens a WebView to run any JavaScript, and another called loadlib2 that downloads and runs whatever the operators choose.
But in practice, only two commands are used: http and loadlib2. The other seven are unused, and two of those aren’t even complete.
The loadlib2 command downloads a reverse proxy module called zhima. This is the important part. Once it’s active, other people’s traffic is routed through your car.
Nokia found the same module somewhere else
Nokia’s Deepfield Emergency Response Team independently found zhima on Android TV set-top boxes at roughly the same time, without working with Kaspersky. Their write-up is public on GitHub and lines up with what Kaspersky pulled off the head units.
Two teams found the same proxy module on two different types of devices. This isn’t a coincidence. It shows the botnet operator doesn’t care what the device is, as long as it has a residential IP and stays powered on.
Following the thread to a signup page
The attribution work is the best part of the report.
The stage 2 loader spawns a thread named mosdk-host-loader. Kalinin looked up what mosdk meant and found malware on TV set-top boxes with a service inside it called AdmoyuService.
MoYu refers to MoYu Group, which HUMAN Security linked to the BADBOX botnet. With significant infrastructure overlap and the naming, Kaspersky is highly confident in this attribution.
It gets even more interesting. One of zhima’s C2 IPs also responds for admin.uipoxy[.]com, which hosts the zhima admin panel. The panel has an open registration page, so anyone with a valid invite code can sign up.
The terms of service on that signup page link to pxyedge[.]com, which is a company selling residential proxies. The copyright footer mentions proxyforu[.]com, another residential proxy vendor. All three sites use the same login path, admin subdomain style, and signup URL structure.
So the process is: infect a car, enroll it as an exit node, and then sell access to that node as a ‘residential proxy’ to anyone who wants it.
If someone pays $30 a month for a clean residential IP, they’re actually buying access to part of a stranger’s dashboard. Criminal infrastructure has looked like ordinary software for years now — invite codes, terms of service, a billing page. FraudGPT sold subscriptions the same way.
Why cars, specifically
A head unit is a lousy target if you want data. Nobody does mobile banking from their infotainment screen. A banking trojan on a head unit is wasted effort.
But head units often have their own SIM slot and always-on internet connection. They can sit in a driveway for hours and have residential-looking IPs. And nobody, not a single person, is running endpoint security on their dashboard.
For a proxy botnet, this setup is almost perfect. The device doesn’t have anything valuable to steal, which is why nobody is paying attention to it.
What you can actually do about this
Honestly, there isn’t much you can do, and it’s better to be direct about that.
You can’t install security software on most head units, and you can’t check what your dashboard is connecting to. You also don’t get a changelog when it updates. If you have an aftermarket DoFun unit, your best option is to ask the vendor about firmware updates and hope the fix has reached your device.
Dark web monitoring services won’t help here either. They watch for your data appearing in breach dumps and marketplace listings, and this malware never takes any. It’s a different problem with a different fix.
One thing you can do is check your router’s client list from time to time if your head unit connects to your home Wi-Fi. Stage three sends the SSID it connects to back to the operators, so they already know that information.
If you do network monitoring on a large scale, the Kaspersky report includes full IoCs: hashes for all three stages, eight zhima variants, and the .sbs C2 domains (kshahnd, mdsjhd, nmnsny, xmsae, and others). These are worth adding to your blocklist.
The part that should bother you
BADBOX has been disrupted. Google sued 25 unnamed entities in China over it in July 2025. Researchers have been dismantling its infrastructure for two years.
Now, the people behind it have started targeting cars.
There’s nothing clever in the code, either. No AI-assisted development like VoidLink, no zero-day, no novel technique. In this case, the delivery method wasn’t a vulnerability that can be fixed like a typical bug. It was a legitimate update system doing what it was meant to do, just aimed at the wrong file. Any device with a self-updating system app is at risk—TVs, set-top boxes, and now dashboards.
The first documented case is always interesting, but it’s rarely the last.
Source: Kaspersky Securelist, “The invisible passenger in your car,” Dmitry Kalinin, 21 August 2026. Independent zhima findings from Nokia Deepfield ERT.
