Malware Infects Cars via Android Infotainment Systems

Experts from the security firm Kaspersky have published an alarming report detailing a novel malware that infects modern infotainment systems in vehicles. This malware exploits the update process of the affected systems to embed itself. It does not have its own app interface but displays advertisements containing malicious links. According to Kaspersky, the infotainment systems from the Chinese manufacturer Dofun are affected. These systems are not factory-installed in vehicles but are specifically designed for retrofitting Android Auto.

The security researchers were able to demonstrate that attackers compromised a system app called TWCore, which was originally intended for collecting analytics data and updating the software. The attackers apparently managed to intercept the data transmission between the manufacturer server and the app. This allowed them to inject their own installer, which embedded the malware directly into the infotainment system without the user's notice. This method makes it particularly difficult to detect and remove the malware. The researchers informed Dofun about the security vulnerability to close the loophole and remove the harmful software.

Despite the successful intervention by the security researchers, the malware is already active and could potentially affect many vehicles equipped with these systems. The malware is not only used to display fraudulent websites on the infotainment screen but also to build a botnet. This botnet enables the attackers to control and coordinate further attacks. Fortunately, the hackers were unable to manipulate essential vehicle functions, which reduces the danger to driver safety. Connected devices such as smartphones or tablets could also be affected by the malware.

However, Kaspersky has not released specific figures regarding the spread of the malware. Users should therefore consider checking their potentially affected devices with antivirus software. The security experts do not provide concrete recommendations on how users can protect themselves from this malware. Since the malware entered the system through official sources, it is particularly challenging to detect. An update of the system software by the manufacturer is the only known way to resolve the issue.

To protect themselves, users should regularly update their infotainment software and install the latest patches for Android Auto. In July 2026, there was a major update that significantly improved the use of WhatsApp, among other things. These updates are crucial for ensuring the security of the systems. The discovery of this malware raises questions about the security of infotainment systems in modern vehicles. Given the increasing connectivity of vehicles and the integration of smartphone functions, it is essential that both manufacturers and users pay attention to security updates.

The security vulnerability could potentially affect other manufacturers using similar systems. The vulnerability has already been classified as critical, and Kaspersky has forwarded the information to the relevant authorities. The researchers emphasize the need to raise security standards in the automotive industry to prevent such attacks in the future. The malware attack on Dofun's infotainment systems is an example of the growing threats in vehicle technology. Experts warn that such attacks could increase in the future as more vehicles are equipped with connected systems. The vulnerability was discovered on August 20, 2026.