Your Dashboard Might Be Someone's Proxy Exit: a Field Check for the DoFun Head Unit Botnet

The malware did not break into the head unit. The head unit's own updater installed it, silently, as a routine software delivery. That detail from Kaspersky's June 2026 disclosure is the part most coverage glosses over, and it is the part that tells you how to defend yourself.

If you drive a car with an aftermarket Android screen, this article has two jobs: explain why this campaign was inevitable, and give you a ten minute check you can run tonight.

What Kaspersky actually found, in two minutes

The targets are Android head units running software from DoFun, a Chinese company that builds firmware, apps, and cloud services for automotive infotainment and claims more than 30 million vehicle owners on its own website. Kaspersky calls it the first documented case of malware on a car head unit with an infection chain specific to that device type.

The chain abuses TWCore (package com.tw.core), a legitimate system app that collects analytics and delivers firmware updates as APK files. TWCore takes its instructions from an MQTT message broker on a cardoor[.]cn subdomain and drops downloaded APKs into a push/apk/ folder under its external cache directory. Attackers used that channel to deliver JarService, an empty app with no interface that needs zero user interaction. JarService decrypts a loader, the loader phones home over HTTP, and the server hands back a payload at 144.217.243[.]201/vr34der34/dex3.68.png. The version number sits right in the filename, so Kaspersky simply iterated it and pulled seven variants going back to 3.57. That tells you this ran for a while before anyone looked.

The final payload is an ordinary user app with no icon. Every 90 minutes it POSTs to /cpc/api/task with device info and its config version. It supports nine commands (return, copy, http, web, loadlib, loadlib2, loadlib3, deeplink, traceroute), covering ad fraud, arbitrary JavaScript in WebView, clipboard manipulation, and fetching more modules. Two commands are stubbed out as not fully implemented. This is a platform under construction, not a finished product.

The money angle is twofold: click fraud, and turning the unit into a residential proxy node via a reverse-proxy module called zhima. DoFun fixed the abused distribution mechanism after responsible disclosure.

Why aftermarket infotainment was a matter of when, not if

Here is the supply chain problem in one sentence: a handful of firmware houses ship software inside units sold under dozens of brand names, and the seller on the marketplace listing often has no idea whose updater is inside.

That shape has three ugly consequences.

The update channel is a standing install primitive. TWCore installs APKs based on server instructions, with no user in the loop. A setting called installNotExists controls whether it can install apps that were never on the device; only when that flag is false does TWCore restrict itself to updating what is already installed. You do not need an exploit when the front door installs whatever the server sends. The entire campaign needed no vulnerability in the traditional sense, just control of a trusted delivery pipe.

This is the TV box playbook, moved to the driveway. Kaspersky attributes the campaign with high confidence to the MoYu Group, an actor tied to the BADBOX ad fraud and residential proxy ecosystem. A thread inside the loader named mosdk-host-loader points at MoYu-linked malware previously found on TV set-top boxes, and a separate research team independently spotted overlapping infrastructure. The zhima proxy module itself was documented by Nokia's Deepfield Emergency Response Team the month before, delivered through IPTV apps on cheap Android TV boxes. Same operators, same modules, new device class.

Lawsuits did not stop it. In July 2025, Google sued 25 unnamed individuals or entities in China for allegedly running BADBOX. Roughly a year later, the same ecosystem was installing on cars. The botnet's admin panel shares embedded URLs with residential proxy services PXYEDGE and ProxyForU, and investigators tied one zhima server to admin.uipoxy[.]com, which hosted a proxy administration panel whose registration pages referenced a residential proxy provider's documents. Ad fraud pays per impression and residential proxies pay per gigabyte, and both monetize any device that sits powered and networked with nobody watching. A parked car on your home WiFi qualifies. Takedowns raise the operators' costs; they do not remove your exposure.

Step 1: Find out if your unit is a DoFun unit

Most owners do not know what firmware they run. Three ways to check, easiest first:

1. Open Settings, then About, and look for DoFun, TWCore, or cardoor.cn in the firmware version or update server strings.
2. In Settings, Apps, show system processes and look for TWCore.
3. If you can get a shell (many of these units expose ADB over USB or WiFi, sometimes enabled out of the box):

adb shell pm list packages | grep -i "tw.core"

If com.tw.core comes back, the rest of this article applies to you. No ADB? Watch your router's DNS log while the unit is on WiFi. DoFun-based units talk to cardoor[.]cn subdomains, because that is the legitimate update broker.

Step 2: Infection checks that take ten minutes

Kaspersky's telemetry showed JarService repeatedly appearing in TWCore's download folder and being installed by com.tw.core. That gives us concrete things to look for.

List third-party apps and their installers:

adb shell pm list packages -3
adb shell pm list packages -3 -i

The second command shows the installer next to each package. Flag anything you did not install yourself, especially a UI-less app with a generic name (JarService is the known one), and treat any package whose installer is com.tw.core but which is not a known firmware component as hostile until proven otherwise.

Check the drop zone:

adb shell ls -la /sdcard/Android/data/com.tw.core/cache/push/apk/

The exact path varies by unit, but it is the push/apk/ folder under TWCore's external cache directory. Leftover APKs there that never became legitimate updates are a red flag.

Watch the network, no ADB required. Give the head unit a DHCP reservation and log its traffic for a day. Red flags:

• HTTP POSTs to a /cpc/api/task path on roughly a 90 minute cadence. This is the strongest signal and the easiest to alert on.
• Any connection to 144.217.243[.]201 or admin.uipoxy[.]com.
• Sustained outbound relay traffic. A proxy node opens many connections to many destinations; a healthy head unit talks to a handful of map, streaming, and update endpoints. A unit pushing gigabytes while parked is not fetching map tiles.
• Remember that cardoor[.]cn lookups alone are expected on DoFun units. The signal is everything else.

If you have root, one more confirmation: the Trojan stores its command identifiers (the attackers call them productId) as serialized JSON in SharedPreferences, so the suspect app's shared_prefs will contain that JSON.

Step 3: Mitigations that actually work

Remove the payload. The final stage is a regular user application, so removal does not require rooting. Uninstall anything you cannot account for:

adb shell pm uninstall --user 0 <package.name>

Update the firmware. DoFun closed the abused distribution path after disclosure, so getting current matters. Honest caveat: in the aftermarket world, updates usually come through the seller, and sellers churn. If your seller cannot produce an update, treat the unit as unpatchable and lean hard on network controls.

Segment the unit. Put it on its own SSID or VLAN, or behind a travel router between it and your phone. Client isolation on, no access to your home LAN, egress filtering if your gear supports it. A head unit needs outbound access to a short list of services. It needs nothing inbound and nothing to your other devices.

Lock down installs at the Android layer. Turn off the global unknown-sources toggle on older builds, or revoke "install unknown apps" from everything except the store on newer ones. There is no owner-facing switch for TWCore's installNotExists behavior, which is precisely why the fix had to come from DoFun's side.

Baseline and alert. A simple DNS or firewall rule that flags /cpc/api/task POSTs or the known hostile hosts catches reinfection and the next family that reuses this pipe.

Buy differently next time. Ask the seller whose firmware and updater the unit runs. Search the model number plus com.tw.core. Prefer vendors that publish an update policy. If the seller cannot answer the firmware question, that is your answer.

The pushback I keep hearing

"Nothing here touches the car. It is ad fraud."

Mostly fair about this specific campaign, and I would push back on anyone claiming steering or braking risk from this disclosure, because the evidence does not show that and most aftermarket screens are loosely coupled to the vehicle. But it misses what actually happened. Your head unit became a residential proxy exit, meaning strangers' traffic leaves through your phone hotspot or your driveway WiFi with your IP address on the far end's logs. It exfiltrated your device model, display resolution, WiFi SSID, and MAC address. And the delivery primitive, server tells updater to install an APK with no questions asked, does not care what APK it delivers. Today's payload clicks ads. The same pipe can carry anything the operators decide to sell next, and the unfinished command stubs tell you they are still building.

Key takeaways

• Check for com.tw.core in your package list or cardoor[.]cn in your DNS logs. If present, you are on DoFun firmware and should run the full check.
• Core IoCs: a UI-less JarService app installed by com.tw.core, POSTs to /cpc/api/task every 90 minutes, 144.217.243[.]201, admin.uipoxy[.]com, the zhima proxy module, and panel artifacts tied to PXYEDGE and ProxyForU.
• Removal is easy because the payload is a normal user app. Keeping it off requires current firmware plus network segmentation, since the updater itself was the delivery vehicle.
• Any head unit with silent, server-driven APK installs deserves this scrutiny regardless of brand. DoFun got caught; the pattern is industry-wide.
• TV boxes were the rehearsal and cars are the rollout. Treat a cheap Android screen in your dashboard with the same suspicion you would give a cheap Android box in your living room.