PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“The invisible passenger” is Android malware that Kaspersky says reached some DoFun automotive head units through their built-in TWCore update mechanism. The reported campaign was designed for ad fraud and proxy-botnet activity; Kaspersky says the vendor later reported fixing the distribution issue. The report does not show that every affected head unit was updated or that vehicle safety systems were compromised.
What is the invisible passenger?
It is a multi-stage Android malware chain described by Kaspersky in a report published on 21 August 2026. Kaspersky says it discovered the malware while monitoring Android threats in June 2026 and characterizes the incident as the first documented malware infection chain specific to a car head unit. That “first documented” description is Kaspersky’s characterization, not an independently verified inventory of every such incident.
As an Amazon Associate I earn from qualifying purchases.
Automotive head units provide multimedia features and may have partial control over some vehicle functions. They can be factory-installed or aftermarket; some run Android and connect to the internet for services such as navigation and software updates. Kaspersky’s report concerns Android-based head-unit firmware, including DoFun firmware. It does not establish that all cars, or all Android head units, were affected. Read Kaspersky’s report.
How did it get onto a head unit?
Kaspersky says the initial distribution channel was TWCore, a legitimate system application used for analytics and software updates. An MQTT broker sent TWCore instructions to install APK files. The instructions could include an installNotExists Boolean flag, which, when enabled, allowed installation of apps that were not already on the device. Kaspersky’s telemetry found the malware installed by an app using the package name com.tw.core, matching TWCore.
#1 Best Overall
- UPSCALED 4K FRONT + 1080P REAR DUAL DASH CAM: The ROVE R2-4K DUAL records the road ahead and behind at the same time. The front camera captures at 2.5K (QHD) and intelligently upscales to 4K (2160P) for higher-detail playback, while the rear camera records at Full HD 1080P. This is upscaled 4K, not native 4K, engineered to show sharper everyday detail than standard 1080P dash cams, so you can read license plates, signs, and surroundings in front and rear footage.
- SONY STARVIS 2 IMX675 SENSOR + SUPER NIGHT VISION: The front camera uses a Sony STARVIS 2 IMX675 5MP image sensor with a wide F1.5 aperture (F1.8 rear) and HDR to pull in more light for clearer low-light footage. This advanced sensor enhances nighttime clarity, helping capture license plates, road signs, and surrounding vehicles with greater reliability when driving after dark, through tunnels, or in dusk and dawn conditions.
- ULTRA FAST 5.8GHz WIFI/ UP TO 20MB/s DOWNLOAD SPEED: With its built-in dual-band 5.8GHz and 2.4GHz WiFi, you can use the ROVE dash cam app to view and manage dash cam recordings instantly on your iPhone and Android smartphone. Using the ROVE app, download your recorded videos directly to your smartphone at up to 20 MB/sec, then easily share them on social media with friends and family. Additionally, manage camera settings and update the latest firmware over-the-air via the ROVE App.
- CAR CAMERA WITH GPS: The new front and rear dashcam comes with built-in GPS, which enables you to view real-time live speed and compass on the 3” IPS wide camera screen. It records precise driving routes, locations, and speed stamps directly on the video so you can watch dashcam videos with GPS data using ROVE's free GPS Player on your PC or Mac & get additional evidence when you need it.
- FEATURES WITH STATE-OF-THE-ART TECHNOLOGY INCLUDED: Experience peace of mind with this front and rear car dash cam. It comes with a free 128GB microSD card and offers advanced features such as an f1.5 aperture, motion detection, G-sensor, seamless loop recording, emergency video lock, screen saver, live speed and compass direction, voice guidance, ring of threads for optional CPL filter, a built-in supercapacitor for extended product life, support for up to 1TB microSD cards, and many more.
That route matters because the reported installation involved a built-in updater rather than a driver downloading an obviously suspicious app. The report describes how this campaign used the updater; it does not establish that TWCore or every device using it was malicious.
What did the malware do?
Kaspersky describes three stages, each with a different role:
Rank #2
- ❗❗❗NOTE: This product must be powered by the original cigarette lighter charger; it cannot be powered by a USB cable or a Type-C cable. IIWEY N5 dash cam equipped with a 3" IPS screen, FHD 1080P+1080P+1080P+1080P, which can record 360° all-round including front, rear, sides, and interior. It also features a 2.5K+1080P+1080P+1080P mode for diverse needs. In addition, N5 is equipped with 170° super wide-angle front and rear cameras and 150° wide-angle side cameras, providing a wide field of view.
- ❗❗❗NOTE: N5 dash cam DON'T HAVE GPS function. The 128GB SD card has been installed in the card slot. It connects to your cellphone via built-in WiFi, no Bluetooth. The rear camera must be wired and connected to the front camera for use. It uses a super-capacitor instead of a battery, so please keep the dash cam connected to a power source while in use, we recommend to use the included car charger, or you can use our HARDWIRE KIT (ASIN B0DHJNRPB9, sold separately).
- 【Loop Recording & Free 128GB SD Card】N5 Dashcam comes with a 128GB Micro-SD card. (supports up to 256GB) Loop recording will start immediately once you turn on the engine. No seconds will be missing. The video will be saved in segments, and the storage space will be automatically detected. When memory is full, the earliest recorded video will be automatically deleted to achieve seamless loop recording.
- 【5GHz WiFi & Free App Control】❗❗❗NOTE: There are currently two free apps available: iiwey and viidure. You can find both apps on the Google Play Store and the Apple Store. The N5 dashcam boasts built-in 5GHz WiFi for 4x faster connectivity than 2.4GHz (with 2.4GHz support). It pairs with a free app for Android or iOS, enabling seamless control, video preview, download, and sharing.
- 【WiFi Using Note】Please note that each time you want to connect the APP to the dash cam, you need to long press the " ◀ " button to turn on WiFi before you can connect. ❗❗❗If the WiFi is not connected to the APP for more than 5 minutes, the dash cam will automatically turn off the WiFi function. This measure is to prevent the dash cam from overheating.
- JarService dropper: This UI-less first stage decrypts data embedded in its code, including payload information.
- Loader: It contacts command-and-control infrastructure and obtains the next stage.
- Clicker and reverse-proxy loader: It reports device details and configuration information, then receives commands.
The reported purposes included ad fraud and creating a proxy botnet. Kaspersky also reports a default 90-minute check-in interval; this is an observed behavior in the report, not a prevalence statistic or a guarantee that every infected device checked in at that interval.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Who was behind it?
Kaspersky attributes the activity with high confidence to MoYu Group, which it links to the BADBOX botnet. This is Kaspersky’s assessment of the campaign, not an independently proven identification of the people responsible.
Rank #3
- [4K+1080P Front & Rear Recording] REDTIGER F7NP dash cam captures every detail with stunning 4K front and 1080P rear video. Featuring the advanced STARVIS 2 sensor plus the 170° front and 140° rear wide-angle lens, this dash camera delivers sharper images, balanced lighting, and reliable evidence day or night. Ideal for commuting, road trips, rideshare drivers, and new drivers.
- [STARVIS 2 Sensor & WDR Night Vision] Equipped with the advanced STARVIS 2 sensor, F1.5 large aperture, and 6-layer optical lens, F7NP 4K dual dash cam delivers clear, high-contrast footage in any lighting. WDR and HDR technology balance highlights and shadows, ensuring sharp night vision and crisp details day or night, providing reliable evidence and enhanced safety for every drive.
- [Built-in 5.8GHz WiFi & Smart App] Connect your smartphone to the dashcam’s built-in 5.8GHz WiFi to enjoy ultra-fast downloads up to 20MB/s. Using Redtiger Cam app, you can preview, download, and replay videos in real time, check GPS ata (route, speed, and location), and manage settings effortlessly, making it simple to review footage and share important moments.
- [Loop Recording & Free Memory Card] This car camera supports seamless loop recording to ensure continuous coverage without interruption. Older files are automatically overwritten when storage is full, while important events are safely locked. A free memory card is included, giving you ample space for 4K recordings and allowing you to use the camera right out of the box.
- [24/7 Parking Mode* & G-Sensor] Enjoy round-the-clock protection with two parking modes: time-lapse recording for continuous low-bitrate monitoring and G-sensor mode that records when collision is detected. The car security camera with G-sensor automatically locks important clips, ensuring crucial evidence is safely preserved even while your vehicle is parked.(*Hardwire kit needed.)
The report lists detections including HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.* and HEUR:Trojan.AndroidOS.Vo1d.*. These names can help security teams recognize related detections; they are not evidence that a particular vehicle is infected.
Was the issue fixed, and what should owners do?
Kaspersky says it notified the vendor about the distribution scheme and that the vendor subsequently reported fixing the security issues. The report does not identify affected firmware versions, document updates on individual devices, or confirm that all deployed head units received a fix.
Rank #4
- 4-Channel Dash Cam for Complete Vehicle Coverage: This dash cam is equipped with four Full HD 1080P cameras, capturing footage of the front, rear, left, and right sides of your vehicle simultaneously. The adjustable front cameras enhance visibility and offer flexible recording angles, including interior footage.
- Time-Lapse Recording & Parking Mode: With time-lapse recording, 60 minutes of footage is compressed into 1 minute, saving memory card space. Activate parking mode with the optional ACC hardwire kit (sold separately) for security when your vehicle is parked.
- Enhanced Night Vision & WDR Technology: The dash cam features advanced night vision and Wide Dynamic Range (WDR) technology for clear, balanced footage, even in low-light conditions. Eight infrared lights ensure optimal visibility, and WDR adjusts exposure to capture detailed images in varying lighting.
- Optional GPS for Real-Time Vehicle Tracking: Purchase the GPS logger (sold separately) to add location, speed, and time tracking, providing a visual representation of your vehicle's route. This feature is perfect for documenting travel details in case of incidents.
- 5GHz Wi-Fi & App Integration: Share videos easily via Wi-Fi using the mobile app for both iOS and Android devices. This feature allows for quick video downloads and sharing on your preferred platforms.
If you own or manage a DoFun head unit, ask the head-unit vendor for guidance specific to your model and firmware, including whether an update is available and how to verify installation. Do not assume that a general Android update, antivirus scan, or unrelated car accessory addresses this updater issue: Kaspersky’s report does not identify any of those as a remedy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the report does—and does not—say about vehicle safety
Kaspersky describes head units as having partial control over some vehicle functions, but its report does not establish that brakes, steering, or other safety-critical systems were compromised or targeted. Treat this as a reported compromise of an Android head-unit update channel and malware activity on affected devices—not proof of a vehicle-control attack.
For organizations responsible for connected vehicles or fleets, the incident suggests practical questions to raise with suppliers: are head units inventoried by model and firmware, are update instructions and application integrity validated, and can unusual outbound or proxy traffic be detected? These are security considerations prompted by the incident, not measures that Kaspersky’s report says it tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
