{
  "id": 2690213,
  "title": "JarService / zhima Malware Entering via Insecure Android Car Head Unit Update Paths",
  "url": "https://urgent.news/2026/08/23/jarservice-zhima-malware-entering-via-insecure-android-car-head-unit",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T01:05:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/jarservice-zhima-malware-entering-via-insecure-android-car-head-unit-update-paths-221l"
  },
  "original_language": "en",
  "account": "A recent cyber attack involved the infiltration of Android car head units through insecure software update paths. The malicious JarService and zhima malware were distributed via a legitimate update mechanism used by DoFun Android car head units. This supply chain attack utilized MQTT to install a new APK on the affected devices, bypassing user interaction. Once installed, JarService decrypted an internal block, loaded a Stage 2 loader, and communicated with a command-and-control server (C2) to retrieve further instructions. The malware collected device information, such as model, screen resolution, Wi-Fi SSID, and MAC address, every 90 minutes and relayed this data to the C2. Additionally, the zhima reverse proxy module allowed the infected device to act as an intermediary for external traffic, generating fraudulent ad clicks. Due to the lack of root access, the malware was installed as a standard user application, making its presence difficult to detect. Visibility for administrators was limited, as Android car head units were typically outside the scope of enterprise EDR tools. Affected vehicles displayed ads and generated fraudulent clicks, but no impact on vehicle driving or control functions was reported.",
  "summary": "1. Basic Information Article Name : The invisible passenger in your car Source : Kaspersky Securelist Publication Date : 2026-08-21 Update Date : None Severity : High Original Source : Kaspersky Securelist Related Sources : Hackers infect Android car head units with proxy botnet malware , Open sesame: inside MoYu's “zhima” proxy and the TV it runs on Related Entities : Malware: JarService, zhima,…",
  "key_points": [
    "JarService and zhima malware infiltrated Android car head units via insecure update paths.",
    "Malware distributed through legitimate DoFun Android car head unit updates using MQTT.",
    "Malware collected device information every 90 minutes and relayed data to C2 server."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}