Cybercriminals Launch Attacks on Android Systems in Cars

This is what Ixbt.com reports .

According to the researchers, the malware was distributed through the firmware update mechanism of devices using DoFun software. By abusing the TWCore application designed to analyze and install updates, the criminals managed to deliver the JarService downloader to the device.

How the malware works

Once installed on the device, the malware operated directly in the background without displaying any external interface. During its activity, it could show unwanted advertisements to users, carry out fraud involving advertising services, and secretly download additional malicious modules.

The attackers also collected various confidential data through the car’s multimedia system. In particular, personal and technical information such as the exact device model, screen size, Wi-Fi network identifier, and MAC address was put at risk.

Traces of the hackers and security measures

According to the experts’ analysis, the dangerous attack may have been carried out by the MoYu group, previously linked to the BadBox botnet. The cybergroup was already known for infecting various Android devices, including TV set-top boxes and mobile devices. The new campaign shows that similar threats are now actively entering the automotive industry as well.

After the threat was detected, the relevant software provider was immediately notified and reported that the issue had been resolved. However, experts remind manufacturers that multimedia systems in cars remain constantly connected to networks, requiring a more serious approach to cybersecurity.