The DoFun head unit botnet used zero exploits. The updater did the work.

Most coverage of Kaspersky's June 2026 DoFun disclosure buried the lede: nothing was hacked. The malware arrived through TWCore (com.tw.core), the legitimate system app that ships firmware updates on DoFun-based Android head units, installed silently as a routine push. DoFun builds firmware and cloud services for aftermarket infotainment and...