New Android malware slips into cars through the dashboard's own update system
Kaspersky says the DoFun head unit malware turns infected vehicles into ad-fraud engines and proxy relays for cybercrime.
Key points
- Kaspersky discovered the malware in June 2026 hiding inside Android head unit firmware made by DoFun, a supplier of in-car infotainment systems.
- The malicious code arrived through the head unit's own built-in software updater, so drivers had no reason to be suspicious.
- Once installed, the malware downloads further stages that commit ad fraud and turn the car into part of a proxy botnet, a rented network of hijacked devices used by other criminals.
- No customer payment or account theft has been reported, but affected cars silently generate traffic and revenue for the attackers.
- Kaspersky has not yet named the car brands using the compromised DoFun firmware.
Your car has a computer in the dashboard. It plays music, shows the reversing camera, and often runs a stripped-down version of Android, the same operating system Google makes for phones. Security researchers at Kaspersky say someone has worked out how to plant malware, meaning malicious software, directly inside that dashboard computer.
The target is head unit firmware built by a company called DoFun. A head unit is the screen and computer that sits in the middle of the dash. Firmware is the built-in software that makes it work. Kaspersky, which first flagged the campaign in June 2026, says the infection spreads through the head unit's own update mechanism, the part that normally fetches map data or bug fixes. The attackers pushed their own payload through it instead.
The technical details point at a supply-chain problem rather than drivers doing anything wrong.
How does malware end up inside a car?
Through the updater that came with the car. The head unit checks a server for new software, the way your phone checks for updates. In this case the update package was serving a malicious file, and the head unit trusted it and installed it.
That's what makes this ugly. The owner didn't click a bad link. They didn't sideload an app. The car updated itself, and the update was poisoned.
Kaspersky describes the payload as a multi-stage downloader. The first piece of malware to land is small and quiet. Its job is to phone home and pull down the bigger, more useful modules once the coast is clear.
What does the malware actually do?
Two things, and neither is dramatic enough for a driver to notice. It commits ad fraud, silently loading adverts in the background so criminals collect payouts from advertising networks. It also enrols the car into a proxy botnet: a rented crowd of internet connections where other criminals pay to route their traffic through ordinary home or car connections instead of a suspicious data centre. Your car, sitting on your drive, could be laundering someone else's cybercrime traffic over your mobile data plan.
| Detail | What Kaspersky reports |
|---|---|
| Discovered | June 2026 |
| Target | Android head units with DoFun firmware |
| Delivery | Built-in software updater |
| Payload | Multi-stage downloader |
| Goals | Ad fraud and proxy botnet |
Should drivers be worried?
Not panicked, but aware. There's no sign the malware steals banking details or interferes with driving. The risk is more that your vehicle is quietly working a second job for criminals, and that whoever controls the downloader could push new modules later.
If you drive a car with an aftermarket or lesser-known Android infotainment unit, ask the dealer whether DoFun supplies the firmware and whether a clean update is available. Watch for the head unit behaving oddly: overheating when parked, chewing through mobile data, or rebooting without reason.
This connects to a pattern we've tracked since August. The Bendix EC-80 brake-controller recall we reported on 7 August showed that vehicle software vulnerabilities can hide inside routine maintenance cycles; the DoFun case shows attackers have learned to exploit that exact trust.
This is an authentication and supply-chain story more than a driver-error one. The update channel should have required signed packages that the head unit cryptographically verifies before install. Where that check is missing or weak, whoever controls the update server controls the car's computer. MFA on driver accounts wouldn't have helped here. Signed firmware and a locked-down update pipeline would have.
