# The Android Screen in Your Car Deserves an Update Check

> Researchers found malware delivered through the updater on some DoFun-based Android car screens. Here is what owners should check, without treating every dashboard as a driving emergency.

- **Author:** Kubilay Tunca
- **Published:** 2026-08-23
- **Category:** For Mortals
- **Tags:** Online Safety, Connected Devices, Automotive Security, Malware
- **Canonical URL:** https://cyber-security-in-plain-english.com/post/mortals/news/android-car-screen-update-check

---

The screen in the middle of a car tends to disappear into the furniture. It plays music, shows a map, takes a Bluetooth call, and perhaps displays the reversing camera. If you bought an aftermarket Android screen for an older car, you probably chose it because it made the dashboard more useful. You did not sign up to become the system administrator for a small computer bolted beside the steering wheel.

On 21 August 2026, Kaspersky published research into malware found on Android-based car head units using software from a company called DoFun. The researchers say the malicious app arrived through TWCore, a legitimate system application responsible for updates and analytics. Once installed, it could fetch more code, generate fake advertising activity, and turn the car screen's internet connection into a route that strangers could rent and use. [Kaspersky calls this the first documented malware infection chain designed specifically around automotive head units](https://securelist.com/android-head-unit-malware/121106/).

That description needs two limits attached. The finding concerns DoFun-based units observed by Kaspersky, rather than every Android screen or every modern car. Public reporting also says the malware was being used for advertising fraud and a proxy network, with [no reported interference in driving or critical vehicle controls](https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/) as of 23 August 2026. This is a connected-device maintenance problem with an unusual address. It is not a reason to assume the brakes or steering have been taken over.

There is a useful action hiding inside the strange headline. Find out what screen you own, who supplies its software, whether its updater has a current fix, and whether it still needs its own route to the internet. If an installer fitted it, you can hand most of that work back to the installer. Your job is to ask a better question than “Is my car hacked?”

## What the researchers actually found

Kaspersky says it first noticed the Android malware in June 2026. The initial application, which the researchers named JarService, looked odd because it had no visible screen, icon, or attempt to imitate a familiar app. That made sense once they reconstructed the route in: the driver had not been tricked into tapping an install button. The unit's existing update software had installed it in the background.

The affected route began with TWCore, a legitimate DoFun system application. Under normal use, TWCore receives instructions about Android application packages that a head unit should download and install. Updates need that power because replacing software is the purpose of an updater. Kaspersky found that the same channel could be instructed to install an application that was not already present, and its telemetry linked the observed JarService files to the TWCore package name.

JarService was only the first parcel. It unpacked a loader, which contacted an outside server and received the location of another stage. The later code reported details such as the device model, screen resolution, Wi-Fi network name, and network hardware address. It could then receive commands to make web requests, open pages, run code inside a web view, or download and execute another module. [The Hacker News independently reported the same reconstructed sequence on 21 August](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html), while making clear that the technical findings came from Kaspersky's investigation.

The module observed in use was called zhima. It turned the infected unit into a reverse proxy, which is an unnecessarily technical name for a borrowed exit door. Somebody elsewhere could send internet traffic through the car screen, and websites at the far end would see the connection coming from the screen's public internet address. The owner supplies the device, electricity, mobile data or Wi-Fi, and apparently ordinary address. The person renting the route supplies the activity.

Kaspersky also found commands suited to advertising fraud. A compromised screen can quietly request pages or simulate ad activity without needing anything valuable from the driver. That explains why a device with no banking app and few personal files can still be profitable. The criminal is borrowing its attention, computing time, connection, and address rather than searching the glovebox for a secret.

The researchers attributed the activity with high confidence to the MoYu Group, an operator previously linked with the BADBOX family of compromised Android devices. Their reasons included names found in the code and overlap in network infrastructure. Nokia's Deepfield Emergency Response Team had [independently documented the same zhima proxy mechanism in Android TV boxes in July 2026](https://github.com/deepfield/public-research/blob/main/ipmoyu/report.md), which supports the explanation of what the proxy does. It does not independently count infected car screens or prove who operated every one.

DoFun told Kaspersky that it had fixed the security issues after notification. That is encouraging, though a vendor-side fix and an installed fix are two different events. A car screen that no longer checks for updates, cannot reach the corrected service, or has already received unwanted code may need attention from its supplier. The public research does not provide a simple consumer list of every affected brand, model, serial number, country, or installation date.

That missing list matters. DoFun sells software and cloud services that can appear beneath other product names, and [the company says its services reach more than 30 million car owners](https://www.dofun.cc/xolio/index-en.html). That is a statement about the supplier's overall reach, not a count of infected units. Neither Kaspersky nor the independent reports reviewed for this article says that 30 million screens received the malware. Large supplier, specific observed route, unknown public victim total: keep all three facts together.

## How a trusted update became the delivery van

Most people know the basic advice to install updates. That advice remains sound. The uncomfortable part of this story is that the normal update machinery appears to have carried the unwanted software, so “just update it” feels like being told to open the same door again. The better response is to understand why updates are powerful and then check who still controls that power.

Think of the updater as a garage with permission to replace parts while the car is parked. It needs a delivery address, a list of approved parts, and authority to fit them. If somebody can change the delivery instruction or abuse an over-permissive fitting rule, the garage's legitimate tools do the work. The driver sees no suspicious attachment because no message ever arrived in the driver's inbox.

Android applications usually live behind limits that control what each app may do. A manufacturer-installed system application can have wider rights than an app downloaded later from a store. Those wider rights may be necessary for firmware, dashboards, cameras, vehicle integrations, or unattended updates. They also make the origin and checking of each update especially important. A signature check, tightly controlled server, narrow installation rule, and useful audit record are the equivalent of checking the delivery note before fitting the part.

Kaspersky's report describes an update message containing a flag that allowed TWCore to install an app that did not already exist on the unit. That feature could have an innocent purpose, such as adding a new component to supported systems. In the observed chain, it became the path for JarService. The problem was not that software could be updated; the dangerous combination was a trusted installer accepting an instruction that led to unwanted code.

This distinction protects you from the wrong lesson. Switching off every update forever would freeze any weakness already present and block later repairs. Installing files from an unofficial forum because the official path once failed would replace a known supplier route with a stranger's download. A sound response keeps updates, but gets them through the manufacturer, seller, or installer responsible for the exact unit.

A household example makes the difficulty clearer. Imagine an older car whose original radio was replaced in 2024 with a large Android screen bought online. The box carries one brand, the settings page names another, and the updater comes from a software supplier the owner has never heard of. By 2026, the marketplace listing has vanished. The screen still maps routes perfectly, so nobody has a reason to inspect the software page.

The owner did nothing reckless. The supply chain is simply longer than the name printed on the bezel. Hardware maker, firmware supplier, cloud-update service, marketplace seller, and local installer may all sit between the screen and a repair. When a report names DoFun, finding that name may require opening Settings, About, Apps, System Update, or the paperwork from the installer. It may appear as DoFun, TWCore, `com.tw.core`, or a service associated with the unit rather than the retail brand.

This is why the person who sold or fitted the screen matters. A competent installer should be able to identify the model, firmware source, supported update channel, and current version. If the answer is “download something from this anonymous file-sharing link,” stop. A dashboard computer deserves the same rule as a home router: updates come from an accountable source that can tell you exactly which model they fit.

## What a proxy in the driveway means

The word proxy can sound either protective or criminal because the tool itself is simply a relay. A workplace may use a proxy to filter traffic. A privacy service may route a customer's connection through another location with consent. In this case, the important fact is missing consent: an outside operator can sell or use the car screen's connection while the owner has no idea the relay is running.

Picture a stranger asking to post parcels using your return address. The contents come from them, but the label points back to your house. A residential proxy does something similar for internet traffic. Sites see an address belonging to a household, mobile connection, or ordinary device instead of the true source. That can help an operator evade simple blocks that distrust data-centre addresses.

Nokia's July 2026 analysis of zhima on TV boxes observed tunnel requests that instructed an infected device to connect to destinations chosen by somebody else. Kaspersky later found a zhima module in the car-head-unit chain and identified overlapping infrastructure. Those two investigations concern different device populations, yet together they explain why a car screen can be valuable even when it stores no precious documents. It offers another apparently normal place from which traffic can leave.

What might an owner notice? Kaspersky's consumer explanation says the extra load could make the infotainment system slower or less stable, while relayed traffic could reduce connection speed. A unit with its own SIM may consume more mobile data than expected. A screen using the phone's hotspot or home Wi-Fi on the driveway may borrow that allowance instead. These are possible symptoms, not a diagnosis; old hardware, weak reception, failing storage, and ordinary software bugs can cause the same behaviour.

The public evidence does not show that every proxy customer performed a crime, that an infected address will automatically put its owner under investigation, or that all traffic could reach the rest of the car. It shows an unauthorised route that outsiders could direct. That is enough reason to remove the malware and review the connection, without inventing a cinematic story around it.

There is a privacy edge as well. Kaspersky observed reporting of the connected Wi-Fi network identifier and the unit's network hardware address. Those details are narrower than a complete copy of a phone, but they still describe the device and its surroundings. The malware also had a general ability to download and execute more code, so the final effect could change if operators changed the payload. As of 23 August 2026, the published investigations describe the observed ad-fraud and proxy use; they do not establish theft of every driver's contacts, messages, location history, or microphone audio.

This is an important place to resist fear. Capability tells us what a program could be instructed to do within its access. Evidence tells us what researchers actually saw it doing. Good security decisions use both, but they do not quietly turn one into the other.

## Which drivers should pay attention

Start with the kind of screen you have. An original manufacturer infotainment system, Apple CarPlay, Android Auto, and a standalone Android head unit are related in everyday conversation but different underneath. CarPlay and Android Auto usually display selected functions from a connected phone on the car's screen. A standalone Android head unit runs Android applications on the dashboard computer itself and may have its own app store, storage, Wi-Fi connection, SIM slot, and system updater.

The reported chain concerns Android-based head units powered by DoFun software. An aftermarket screen fitted to an older car is a sensible first place to check, because these products commonly run full Android and may combine hardware and firmware from several suppliers. Factory-installed units can also use Android, but the public report does not say that every Android Automotive system, every factory unit, or Google's Android Auto phone projection is affected.

Open the unit's Settings page while the car is safely parked. Look under About device, System, System update, Apps, or a similarly named section. Record the brand shown on the casing, model number, Android version, build number, firmware version, update application, and seller or installer. A photograph is easier than copying a long build string by hand.

Look specifically for DoFun or TWCore, but treat absence as incomplete evidence rather than a guarantee. Retailers can rename interfaces, applications can hide from the normal launcher, and a software component may be visible only in the full application list. Do not enable developer settings or install a “scanner” from an unknown website merely to hunt for one package. The seller or installer should interpret the model and build details.

If the unit came with the car from a major vehicle manufacturer, use the vehicle maker's official support route or dealer. Give them the vehicle identification number and software version, then ask whether the 21 August 2026 DoFun or TWCore malware report applies. If it does not, you can stop. There is no prize for dismantling a supported dashboard to prove a story about a different platform.

If you bought the screen separately, contact the named manufacturer first, then the seller or installer. Online marketplaces make this awkward because storefronts change and models share similar pictures. Your order history, invoice, packaging, manual, and Settings page can provide the exact model. Ask for a written link to the support notice or current firmware page rather than a bare file sent through chat.

Small businesses have a slightly wider check. Taxis, delivery vehicles, driving schools, hire fleets, tradespeople, and company cars may use aftermarket navigation or media units with separate SIMs. One owner may have several versions bought from different suppliers. Record each unit against the vehicle that contains it, because “we use Android screens” is too broad to reveal which update service each one trusts.

## The check to make while the car is parked

The safe sequence starts with identification and support. Do not attempt it while driving, and do not unplug parts of the dashboard at the roadside. A head unit may control the reversing picture, audio warnings, or settings even when it does not control the vehicle's motion. Treat loss of useful display functions as a practical safety issue and let a qualified installer handle removal or reflashing.

**1. Record the exact unit and software.** Photograph the About and System Update pages. Note the model, Android version, build number, firmware version, updater name, retail brand, purchase date, and installer. If the screen has a separate SIM, note the mobile provider and account that pays for it. This short inventory turns a vague worry into details a supplier can answer.

**2. Ask whether the DoFun or TWCore issue applies.** Use the official manufacturer, seller, vehicle dealer, or known installer route that you find from existing paperwork or the company's real website. The useful question is: “Does this model use DoFun firmware or the TWCore updater, and which fixed software version should it run after the malware report published on 21 August 2026?” Ask whether an ordinary update is enough for a previously unaffected unit and what procedure they recommend if the unit may already have received JarService.

**3. Take the supported update, not a mystery file.** Follow the supplier's instructions for the exact model. Keep the car parked with stable power because interrupted firmware work can leave a unit unusable. If the update arrives through the built-in service, confirm that the supplier has addressed the reported issue. If the instructions require a memory card or USB drive, verify the download address and any checksum the supplier publishes.

**4. Review internet access and data use.** Decide whether the screen needs its own SIM, the phone's hotspot, or access to home Wi-Fi. Check the mobile account for unexplained data use and the unit's Android data-usage screen if it has one. Change the password of a Wi-Fi network shared with the unit only when you have a reason, since that will also disconnect every legitimate device. A simpler first move is to remove a network from the head unit until support confirms the software, provided you can do so without losing a function needed for the journey.

**5. Check installed applications without deleting evidence blindly.** Look for applications you do not recognise and, where the settings permit, show system apps. JarService may use the package name `com.tw.jar1`, while TWCore uses `com.tw.core`, according to Kaspersky's technical report. TWCore itself is legitimate in the described environment, so finding that name does not prove infection. Photograph suspicious entries and ask the supplier or a competent technician before removing system components.

**6. Escalate when the signs line up.** Unexpected mobile data, a unit that has become unusually slow or unstable, an applicable DoFun build, and an unexplained JarService entry together deserve more attention than any one symptom alone. Disconnect unnecessary internet access, preserve the version and app details, and contact the installer or manufacturer. A business fleet should involve its IT or security provider, especially if units have joined office Wi-Fi.

The order matters. Identifying the unit before downloading software prevents a near-match from becoming an expensive brick. Recording evidence before a reset gives support something to examine. Checking connectivity after the software path keeps the response focused on the actual route rather than changing every household password out of habit.

A local installer can be given a precise job: identify the hardware and firmware supplier, confirm whether DoFun and TWCore are present, install the vendor's fixed build, inspect for the JarService indicators in Kaspersky's report, and verify what internet routes remain enabled. Ask for the resulting firmware version in writing. “We updated it” is hard to check six months later; a version and date fit in the service record.

## What to do if you find a likely match

A likely match still has levels. Finding TWCore on a DoFun-based unit shows that the reported software family is relevant. It does not, by itself, show that JarService was installed. Finding the named malicious package or matching technical indicators is stronger evidence, though a consumer should have a technician interpret those details rather than downloading random forensic tools onto the dashboard.

First preserve what is easy to preserve. Photograph the About page, full app list, data-usage screen, update history if available, and any unusual messages. Save the model, build number, SIM account, and dates when slowness or excess data began. If the unit connects to home or business Wi-Fi, note which network it used. Avoid posting serial numbers, account identifiers, or network names publicly while asking for help.

Then stop the unnecessary connection. Remove the unit's SIM or disable its mobile data only if the vehicle and head unit documentation say that is safe. Forget home or office Wi-Fi from the unit where doing so will not interfere with required features. If you are unsure because the screen supplies reversing video or other important functions, leave the hardware powered and ask an installer to isolate its internet connection.

Do not assume a factory reset will repair the update route or remove every stage. A reset may erase useful records and then reconnect the same updater to the same service. Kaspersky says DoFun reported fixing the distribution issue, but the right recovery procedure for a particular model still belongs to its supplier. A clean reflash with a known fixed image may be appropriate; it is not a generic button sequence to improvise from a forum post.

Keep the response proportional. The public research does not report theft of a driver's bank login, control of brakes, or a compromise of every phone paired by Bluetooth. Replacing bank cards, resetting the family router, and wiping every phone would consume time without following the evidence. Start with identities that actually touched the unit and networks the unit actually joined.

A business has another question: what could the head unit reach while parked at the depot? If vehicle screens joined the same Wi-Fi as office laptops, payment systems, or operational equipment, ask the network administrator to review that exposure. Moving vehicle and other connected devices to a separate guest or device network can reduce future reach. Separation will not clean the screen, but it keeps a fault in the car park from receiving an unnecessary corridor into the office.

Mobile providers can help with billing evidence. Ask for data use by date and whether the SIM supports spending caps or alerts. A high total cannot identify the exact application, but it can establish whether the connection behaved differently during the suspected period. Keep those records with the installer report if you need to dispute charges.

If the supplier has disappeared and no accountable source offers fixed software, replacement becomes a reasonable conversation. An unsupported dashboard computer with an active SIM and a privileged updater is not improved by being inexpensive. Choose a replacement with a named manufacturer, published support route, clear update policy, and an installer willing to record the model and software version. Those boring details are worth more than another inch of screen.

## Advice that sounds useful but misses the problem

Removing Android Auto from your phone misses the named route. Android Auto normally projects phone functions into a compatible car display, while the reported malware ran on standalone Android head-unit firmware. Keep your phone updated as usual, but identify the dashboard platform before deleting useful apps.

Turning off Bluetooth alone also misses the observed delivery mechanism. Kaspersky traced the installation to a built-in updater, not to a malicious phone pairing. Bluetooth can have its own security problems, as can any connection, yet changing an unrelated setting creates the feeling of action without checking the route that carried JarService.

A cheap “car antivirus” from an unfamiliar marketplace is a poor bet. System malware delivered through a trusted updater may have access that an ordinary scanning app lacks, and an unknown security app adds another supplier to the chain. Use the vendor's repair route or a technician who can work from Kaspersky's published indicators.

Permanent disconnection is not automatically the answer either. Some owners can live happily without a dashboard SIM, and removing an unnecessary connection is sensible. Others rely on live navigation, traffic, emergency features, or an installer service. Make the connection earn its place, then protect and monitor it. Do not break a function you depend on without understanding the trade.

Nor should you buy a new car because of a report about some aftermarket and Android-based units. The evidence points to software and support, both of which can often be repaired without replacing the vehicle. Even replacing the screen should follow identification and supplier advice. Panic is an expensive shopping assistant.

The broad claim that “connected cars are unsafe” is too vague to help. Connectivity brings updates, maps, calls, diagnostics, and accessibility features that drivers use every day. The practical standard is narrower: a connected component needs a known owner, supported software, a trustworthy update route, and no internet connection left running without a purpose.

## The maintenance habit after the headline fades

A car screen needs a small place in the maintenance record beside tyres, servicing, and insurance. Once or twice a year, photograph its software version, run the supported update, review installed apps, and check whether its SIM or Wi-Fi access still serves a real purpose. Five minutes is enough when the supplier has made the path clear.

Add the check after a seller, installer, phone, mobile plan, or Wi-Fi change. Those moments leave old accounts and forgotten connections behind. A new phone may cause the driver to abandon one dashboard app while its cloud account and permissions remain. A new broadband router may reconnect the screen to a network with more devices than before.

For a family, put the model and support address in the same note as the car's insurance and breakdown numbers. If the person who chose the screen is unavailable, somebody else can still identify it. For a small fleet, keep a row per vehicle with the unit model, firmware source, SIM, current version, last review date, and responsible person. This is ordinary equipment ownership rather than specialist cyber work.

The deeper lesson from the August 2026 research travels beyond cars. Screens, cameras, streaming boxes, routers, and doorbells are computers wearing household costumes. They can look finished while their software and remote services continue changing in the background. Their update channel is a position of trust, so it needs an accountable owner for as long as the device remains connected.

Kaspersky's finding deserves attention because the trusted delivery route was part of the problem. It does not overturn the value of updates. It shows why a good update is more than a file with a newer date: the device should know who sent it, the supplier should control who may publish it, and the owner should have somewhere credible to ask whether it arrived.

If your car has its original supported system and no connection to DoFun or TWCore, you can leave this story with the people whose equipment matches it. If you have an aftermarket Android screen, park the car, photograph the About page, and send one clear question to the company responsible for it. That is enough for today.

For more calm explanations like this, the newsletter sends one email per month. The signup is on this site.

## Sources

- [Kaspersky Securelist: First Android malware targeting automotive head units](https://securelist.com/android-head-unit-malware/121106/), accessed 2026-08-23
- [Kaspersky: Malware in car infotainment systems, how infection occurs](https://www.kaspersky.com/blog/car-botnet-malware-for-head-units-with-android/56296/), accessed 2026-08-23
- [The Hacker News: Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet](https://thehackernews.com/2026/08/android-car-malware-spreads-through.html), accessed 2026-08-23
- [BleepingComputer: Hackers infect Android car head units with proxy botnet malware](https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/), accessed 2026-08-23
- [Nokia Deepfield Emergency Response Team: Open sesame, inside MoYu's zhima proxy and the TV it runs on](https://github.com/deepfield/public-research/blob/main/ipmoyu/report.md), accessed 2026-08-23
- [HUMAN Security: Satori Threat Intelligence Disruption, BADBOX 2.0](https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/), accessed 2026-08-23
- [DoFun: Company cloud services page](https://www.dofun.cc/xolio/index-en.html), accessed 2026-08-23

---

## About the author

Kubilay Tunca — Senior Full Stack Developer and Author. Founded Cyber Security in Plain English to translate complex security concepts into clear, practical advice, and writes the accompanying books on security, privacy, secure development, and AI systems.

## Books by this author

- **The Digital Fortress** — Your Everyday Guide to a Safer Digital Life. A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest. [Amazon](https://buy.cyber-security-in-plain-english.com/digital-fortress) · [Details](https://cyber-security-in-plain-english.com/books/the-digital-fortress)
- **The Anonymity Playbook** — Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else. A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails. [Amazon](https://buy.cyber-security-in-plain-english.com/anonymity-playbook) · [Details](https://cyber-security-in-plain-english.com/books/the-anonymity-playbook)
- **Secure Software Development** — Practical patterns for building secure software. A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-software-development) · [Details](https://cyber-security-in-plain-english.com/books/secure-software-development)
- **The Secure Harness** — Shipping Production Code with AI Coding Agents. A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-harness) · [Details](https://cyber-security-in-plain-english.com/books/the-secure-harness)
- **The AI Native Engineer** — Build, Evaluate, and Ship AI Systems That Work in Production. Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature. [Amazon](https://buy.cyber-security-in-plain-english.com/ai-native-engineer) · [Details](https://cyber-security-in-plain-english.com/books/the-ai-native-engineer)

Full catalogue with contents and intended audience: https://cyber-security-in-plain-english.com/books

_As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog._