Your Car's Infotainment Screen Just Joined a Botnet

According to The Record, researchers at Kaspersky have uncovered what they believe is the first documented case of malware purpose-built to infect car head units — the Android-powered touchscreens that handle navigation, music and Bluetooth in modern vehicles.

The infected devices were made by DoFun, a Chinese automotive software and hardware provider. Attackers compromised a legitimate app called TWCore, which is pre-installed on DoFun devices to handle analytics and software updates. Because TWCore has permission to download and install new apps, attackers used it to silently push a malicious app called JarService onto vehicles — no link to click, no website to visit, nothing for the driver to do.

JarService has no visible interface. Drivers would have no reason to suspect anything was wrong. Once installed, it downloads additional malicious modules. Some display ads and generate fake clicks. Others do something more unsettling: they turn the car's internet connection into a reverse proxy, routing other people's traffic through the vehicle to disguise where that activity originated. Think of it like someone rerouting their calls through your phone number without asking.

Kaspersky attributes the campaign with high confidence to MoYu Group, a threat actor connected to the BadBox malware operation — which has previously shipped malware on Android phones, tablets and streaming boxes before they reached consumers. German authorities disrupted the original BadBox botnet in December 2024, but new variants keep appearing.

If your car runs a DoFun head unit, check the manufacturer's website for a firmware update. More broadly, treat your car's internet connection like any other connected device — it is one.

A Venezuelan national has been sentenced to eight years in federal prison for his role in an ATM jackpotting scheme, according to SecurityWeek. The sentence is believed to be the longest ever handed down for this type of crime in the United States.

ATM jackpotting involves removing an ATM's outer casing, connecting a laptop, and installing malware that instructs the machine to dispense all its cash on command. The defendant, Juan Manuel Gouveia-Aguilera, was held responsible for more than $3.5 million in losses. He is one of 119 individuals charged in Nebraska in connection with the scheme, which prosecutors linked to the Venezuelan criminal organisation Tren de Aragua.

The FBI has warned of a rise in these attacks, with roughly 1,900 reported since 2020 and losses exceeding $20 million last year alone. If you use ATMs, stick to machines inside bank branches where physical tampering is harder to pull off unnoticed.

What Spring for GraphQL is: Part of Broadcom's Spring application framework, a widely used open-source toolkit for building Java-based enterprise software — Spring for GraphQL specifically handles APIs built using the GraphQL query language.

What it is: Cybersecurity firm Sonatype has flagged CVE-2026-59285 as a critical remote code execution (RCE) flaw — meaning an attacker who successfully exploits it can run their own commands on the affected server, with no need for physical access.

Who's at risk: Developers and organisations running applications built on Spring for GraphQL. Sonatype's analysis found the broader Spring patch batch affects more than 200,000 software components.

CVSS: Not confirmed in the source — treat as Critical until the official advisory publishes a score. Patch today.

Root cause: The source does not detail the precise technical mechanism for CVE-2026-59285. The broader Spring release patched 91 flaws, and Broadcom has attributed the surge in part to increased AI-assisted development introducing new code paths that weren't adequately reviewed.

Attack vector: An attacker targeting a vulnerable Spring for GraphQL endpoint could craft a malicious GraphQL query that triggers unsafe code execution on the server. The exact payload format has not been publicly detailed, which limits immediate exploitation — but that window closes quickly once researchers publish proof-of-concept code.

Detection strategies:

1. Check application logs for unexpected GraphQL queries with unusual structure or parameters.
2. Monitor for new outbound connections from your application server shortly after API calls.
3. Review dependency manifests for Spring for GraphQL and compare against the versions listed in Broadcom's advisory.

Recommended actions:

1. Apply Broadcom's Spring framework updates immediately — this is a critical-severity flaw.
2. Restrict external access to GraphQL endpoints where not required.
3. Enable logging on all GraphQL API calls and alert on anomalous patterns.

The Uber fine (covered below) is a useful reminder that EU law gives individuals the right to challenge automated decisions — and similar rights exist in the UK, Canada and California under their respective data protection laws.

If a company tells you that an automated system has denied you a service, suspended an account, or made a significant decision about you, you can ask for a human review. In the EU and UK, this right is explicit under GDPR and UK GDPR. To exercise it, contact the company in writing, reference "automated decision-making," and request that a person reviews the outcome.

It will not always work quickly. But companies that ignore such requests face exactly the kind of regulatory attention Uber just received. Know the right exists — it is worth using.

The Dutch Data Protection Authority has fined Uber €825 million ($964 million) for violating the EU's General Data Protection Regulation (GDPR — the EU's rules governing how companies handle personal data), according to SecurityWeek. The authority found Uber used automated software to permanently suspend driver accounts between 2018 and 2022 with no human review and no meaningful notice to drivers. GDPR prohibits fully automated decisions that significantly affect people. Uber has said it will appeal. For anyone who earns income through platform apps, this ruling is a reminder that automated bans without human oversight are increasingly the target of regulators across Europe.