Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

[XploitLK-Bot]

Cybersecurity researchers have flagged a new malware family specifically engineered to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky discovered the threat in June 2026, and reports that the ultimate objective is to deliver a multi-stage downloader capable of enabling ad fraud and assembling a proxy botnet.

The malware spreads through the built-in updater mechanism used by these head units, which are commonly found in aftermarket car entertainment systems. By compromising the update channel, attackers can push malicious payloads to unsuspecting users as if they were legitimate firmware patches.

Key details from the analysis include:

• The infection chain relies on the vehicle's head unit downloading a seemingly benign update that carries the initial dropper.
• The malware operates in multiple stages, with later stages deploying components for ad fraud and proxy network participation.
• The proxy botnet aspect suggests the compromised devices are being rented out or used for anonymized traffic relay, potentially for other criminal activities.

Given that the malware targets head units, the primary risk is not to the vehicle's core driving functions but to its connectivity and data usage, which can also expose user data to the attackers. Kaspersky’s findings highlight a growing attack surface as more vehicles integrate Android-based systems with internet connectivity.

Source: The Hacker News

Are your organization's fleet vehicles or bring-your-own-device policies accounting for risks in aftermarket Android head units, and how are you monitoring for such firmware-level compromises?