JarService / zhima Malware Entering via Insecure Android Car Head Unit Update Paths

1. Basic Information

• Article Name: The invisible passenger in your car
• Source: Kaspersky Securelist
• Publication Date: 2026-08-21
• Update Date: None
• Severity: High
• Original Source: Kaspersky Securelist
• Related Sources: "Hackers infect Android car head units with proxy botnet malware", "Open sesame: inside MoYu's "zhima" proxy and the TV it runs on"
• Related Entities: Malware: JarService, zhima, HEUR:Trojan-Downloader.AndroidOS.Agent.ov; Groups: MoYu Group, BADBOX; CVEs: None; Products: DoFun Android car head units, TWCore (com.tw.core), MQTT

2. Executive Summary

A supply chain attack that distributes multi-stage Android malware via legitimate vehicle software update apps (TWCore). The malware turns head units into proxy nodes for ad fraud and external traffic relay.

3. Attack Flow

Distribution via Legitimate Update Path

The legitimate system app TWCore on DoFun head units receives an APK installation command from an MQTT broker under cardoor[.]cn. Enabling the installNotExists parameter allows the installation of new apps that do not yet exist on the device. Attackers abuse this update