JarService / zhima Malware Entering via Insecure Android Car Head Unit Update Paths
1. Basic Information Article Name : The invisible passenger in your car Source : Kaspersky Securelist Publication Date : 2026-08-21 Update Date : None Severity : High Original Source : Kaspersky Securelist Related Sources : Hackers infect Android car head units with proxy botnet malware , Open sesame: inside MoYu's “zhima” proxy and the TV it runs on Related Entities : Malware: JarService, zhima,…
A recent cyber attack involved the infiltration of Android car head units through insecure software update paths. The malicious JarService and zhima malware were distributed via a legitimate update mechanism used by DoFun Android car head units. This supply chain attack utilized MQTT to install a new APK on the affected devices, bypassing user interaction.
Once installed, JarService decrypted an internal block, loaded a Stage 2 loader, and communicated with a command-and-control server (C2) to retrieve further instructions. The malware collected device information, such as model, screen resolution, Wi-Fi SSID, and MAC address, every 90 minutes and relayed this data to the C2. Additionally, the zhima reverse proxy module allowed the infected device to act as an intermediary for external traffic, generating fraudulent ad clicks.
Due to the lack of root access, the malware was installed as a standard user application, making its presence difficult to detect. Visibility for administrators was limited, as Android car head units were typically outside the scope of enterprise EDR tools. Affected vehicles displayed ads and generated fraudulent clicks, but no impact on vehicle driving or control functions was reported.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
