# The Malware That Rides In on Your Car's Own Updates
The hardware bolted to your dashboard was never supposed to be a botnet node. Yet here we are.
Kaspersky researchers monitoring Android threat activity in June stumbled onto something they hadn't seen before: malware living not in a phone, not in a router, not in a smart TV — but in the firmware of an automotive head unit. The infotainment module. The thing you use to queue up a podcast and check navigation before a road trip. It was running a multistage downloader, completely invisible, with no interface, quietly waiting for instructions.
This is BadBox territory — and it just expanded its map.
## How the Update Mechanism Became the Attack Surface
The malware, which Kaspersky named JarService, targets head units manufactured by DoFun, a Chinese automotive electronics company whose modules turn up in aftermarket dashboard systems across the global market. What makes this campaign operationally clever is the infection vector: JarService doesn't need a user to sideload anything, click a phishing link, or connect to a malicious Wi-Fi network. It abuses the head unit's own built-in firmware update functionality.
That's a meaningful escalation. Most malware targeting consumer IoT devices exploits weak passwords, exposed services, or ancient unpatched vulnerabilities. JarService weaponizes the very mechanism that's supposed to keep devices secure. The update channel — the thing manufacturers use to push improvements — is what spreads the infection.
Kalinin's threat report describes it as a multistage downloader: the initial infection establishes a foothold, then retrieves additional payloads. The endgame is botnet recruitment. The infected head unit gets folded into a proxy network used for click fraud — the operator's traffic gets routed through your car's SIM card or Wi-Fi connection, inflating ad metrics somewhere upstream while you're oblivious on the highway.
## BadBox Has Been Here Before
The connection to BadBox matters for context. This isn't a new crew — it's an established cybercrime operation with a track record of targeting Android devices at the supply chain level. BadBox's earlier campaigns focused on cheap Android TV sticks, tablets, and set-top boxes, often pre-infected before the devices even reached consumers. The malware was baked into the firmware during manufacturing or distribution, making it effectively invisible to any after-the-fact scan.
The car head unit campaign follows the same logic. If you can compromise the firmware before it leaves the factory or distribution chain, every device that ships is already working for you. The "legitimate" update mechanism then becomes a force multiplier — instead of needing physical access to infect each unit individually, you push the payload through channels the device already trusts.
This is a supply chain attack dressed up as a firmware update. The distinction matters because it changes the defensive calculus entirely.
## What Makes This Harder to Remediate Than a Phone Infection
When your Android phone gets malware, the remediation path — however tedious — is well understood. Factory reset, restore from backup, you're clean. Car head units don't work that way.
Most aftermarket head units run heavily customized, often unverifiable builds of Android. Owners rarely know the firmware version they're running, let alone how to verify its integrity. Legitimate update channels, where they exist at all, aren't authenticated in any meaningful way. There's no equivalent of Google Play Protect watching firmware behavior. And because head units are embedded in vehicle dashboards — not consumer electronics you're accustomed to reinstalling — the friction of remediation is enormous.
The average owner of an infected DoFun-based head unit will never know they have a problem. Their car will still navigate. Music will still play. The unit will just be quietly tunneling attacker traffic in the background, contributing its bandwidth and residential IP address to a click-fraud operation.
That invisibility is by design. JarService has no user interface because it isn't meant to be seen.
## The Larger Orbit of Automotive Attack Surface
Head units sit at an interesting intersection: they're internet-connected (frequently via SIM), they're Android (meaning a familiar attack surface), and they're underdefended (almost no security tooling is deployed on them). They've been theoretically interesting to security researchers for years, but concrete in-the-wild malware campaigns targeting them specifically have been nonexistent — until now.
This isn't yet an attack on vehicle safety systems. JarService isn't touching the CAN bus, it isn't interfering with braking or steering, and the researchers found no evidence of it attempting to access other vehicle networks. The threat today is financial: click fraud, proxy routing, botnet capacity. But the precedent is what should concern automakers and fleet operators. A threat actor that has demonstrated the ability to compromise head unit firmware through the update channel has implicitly demonstrated a pathway into a device category that the automotive industry has not prioritized for security hardening.
The jump from click fraud to something more targeted is not technically enormous.
## HackWire Analysis
BadBox's move into automotive head units is the logical extension of a campaign strategy that's been methodical from the beginning. The group has always gone where Android is deployed in bulk, where firmware integrity verification is lax, and where users have no reasonable mechanism to audit what's running on their device. Cheap Android streaming sticks fit that profile. Budget tablets fit it. Aftermarket head units — particularly from Chinese ODMs sold through Amazon and AliExpress under dozens of brand names — fit it perfectly.
The supply chain angle deserves more attention than it's getting. DoFun builds the hardware that gets rebranded and resold by dozens of distributors. There's no clean list of affected products. When BadBox seeded malware into cheap Android TV boxes, security researchers spent months trying to map which SKUs were affected — and never produced a complete picture. The same problem applies here, compounded by the fact that automotive electronics distribution chains are even less transparent.
For enterprise and fleet operators, the exposure is concrete: company vehicles with aftermarket head units running infected firmware represent live botnet nodes on corporate networks whenever those vehicles connect via mobile hotspot or USB tethering. Security teams rarely think to include head units in their device inventory, let alone their threat models.
The fix demands upstream action — DoFun and similar ODMs need to implement authenticated firmware update channels with cryptographic signature verification. Until that happens, the update mechanism that's supposed to protect these devices remains the most reliable way to compromise them at scale.
Consumers buying aftermarket head units can't easily audit firmware integrity, but they can limit network exposure: treat the head unit's SIM as an isolated data connection, avoid bridging it to a corporate network, and watch for suspiciously high data usage. It's imperfect, but it's the reality of a device class that shipped without security as a design requirement.
— HackWire Editorial
---
## Related Coverage