JLR CAN-bus Theft Update 2026: The Cloned-Module Vector and the Ghost II PRO

The new attack vector

Between late 2025 and spring 2026, a number of JLR thefts were recorded where the owner had a Ghost II fitted. Forensics showed the immobiliser had been bypassed — not by defeating the PIN, but by physically removing the original body control module and substituting a cloned, pre-PINned module that one criminal network had pre-built off-site.

It's a small number of incidents, but it changed the threat model. Autowatch responded with the Ghost II PRO — which adds encrypted rolling-code authentication between the immobiliser and the vehicle's body control module. A substituted module won't authenticate, and the engine won't crank.

Who needs PRO

From April 2025, the Ghost II PRO is the required fitment for:

• Discovery Sport (L550) build from MY25
• Range Rover Sport (L460) build from MY25
• Range Rover Velar (L560) build from MY25
• Range Rover Evoque (L551) build from MY25
• Full-fat Range Rover (L460) build from MY25
• Defender 110 / 90 (L661) build from MY25 — same architecture

If you have an earlier (pre-MY25) JLR vehicle, the standard Ghost II remains correct.

Why we recommend PRO for newer JLRs even where the dealer hasn't asked

Substitution attacks aren't a 2025 issue — they're a 2025-and-onward issue. The criminal investment to build cloned modules is one-off; the same modules work across the JLR fleet for years. PRO encapsulates the authentication step at the module handshake rather than at the dashboard button sequence, blocking substitution regardless of how long the attacker has physical access.

Pricing

• Ghost II standard (MY24-down JLR, plus non-JLR makes): £499 inc VAT fully fitted
• Ghost II PRO (MY25+ JLR specified above): £599 inc VAT fully fitted

Both options: mobile fitting, same-day TASSA certificate, 2-year manufacturer warranty. 0% finance available subject to status (4 × £124.75 / 4 × £149.75).

Book online or call 0333 370 3259.