Malware infects Android-based automotive head unit firmware

In late June 2026, cybersecurity researchers uncovered a novel Android malware strain targeting automotive head units. Unlike typical malware, this malicious application lacked a user interface and installed itself discreetly, raising suspicions of surreptitious installation.

Upon further examination, investigators determined that the malware infiltrated head units without user knowledge, ultimately reconstructing the entire infection process. Kaspersky identified the threats under specific detection names.

Head units, which combine multimedia functions with control over certain vehicle features, can be factory-installed or aftermarket upgrades. Their main vulnerabilities stem from physical access compromise or weaknesses in the operating system or components.

Android's popularity among automotive manufacturers is attributed to its adaptable source code and ability to include vendor-specific system applications during the build process. While most Android apps function on head units, malware poses unique challenges.

Classic Android malware, often used to recruit devices into botnets, might seem less appealing for head unit attacks. However, head units often feature SIM card slots and internet connectivity, making them susceptible to recruitment into botnets.

A key component in this malware chain was TWCore, a legitimate system application tasked with analytics data collection and software updates. The malware exploited TWCore's update function, which involves an MQTT message broker sending APK files for download and installation.

The malware's core is the JarService dropper, a UI-less application that decrypts encrypted blocks within its code. The decrypted data contains information about the payload version and entry point, along with further loading code.

The malware establishes communication with its command-and-control server through POST requests, receiving links to download subsequent stages. The payload versions vary, suggesting an evolving infection chain. The malware also sends information about the infected device to the C2 server at regular intervals, prompting updates to its configuration and communication channels.