New Android malware slips into cars through the dashboard's own update system
Kaspersky says the DoFun head unit malware turns infected vehicles into ad-fraud engines and proxy relays for cybercrime.
Key points
- Kaspersky discovered the malware in June 2026 hiding inside Android head unit firmware made by DoFun, a supplier of in-car infotainment systems.
- The malicious code arrived through the head unit's own built-in software updater, so drivers had no reason to be suspicious.
- Once installed, the malware downloads further stages that commit ad fraud and turn the car into part of a proxy botnet, a rented network of hijacked devices used by other criminals.
- No customer payment or account theft has been reported, but affected cars silently generate traffic and revenue for the attackers.
- Kaspersky has not yet named the car brands using the compromised DoFun firmware.
Your car has a computer in the dashboard. It plays music, shows the reversing camera, and often runs a stripped-down version of Android, the same operating system Google makes for phones. Security researchers at Kaspersky say someone has worked out how to plant malware, meaning malicious software, directly inside that dashboard computer.
The target is head unit firmware built by a company called DoFun. A head unit is the screen and computer that sits in the middle of the dash. Firmware is the built-in software that makes it work.
Kaspersky, which first flagged the campaign in June 2026, says the infection spreads through the head unit's own update mechanism. That is the part that normally fetches map data or bug fixes. The attackers found a way to push their own payload through it instead.
The original write-up appeared through The Hacker News, and the technical details point at a supply-chain problem rather than drivers doing anything wrong.
How does malware end up inside a car?
Through the updater that came with the car. The head unit checks a server for new software, the way your phone checks for updates. In this case, the server, or the update package itself, was serving a malicious file, and the head unit trusted it and installed it.
That is what makes this ugly. The owner did not click a bad link. They did not sideload an app. The car updated itself, and the update was poisoned.
Kaspersky describes the payload as a multi-stage downloader. In plain terms, the first piece of malware to land is small and quiet. Its job is to phone home and pull down the bigger, more useful modules once the coast is clear.
What does the malware actually do?
Two things, and neither of them is dramatic enough for a driver to notice. It commits ad fraud, silently loading adverts in the background so the criminals collect payouts from advertising networks. It also enrols the car into a proxy botnet.
A proxy botnet is a rented crowd of internet connections. Other criminals pay to route their traffic through it, so their attacks look like they are coming from ordinary home or car connections instead of a suspicious data centre. Your car, sitting on your drive, could be laundering someone else's cybercrime traffic over your mobile data plan.
| Detail | What Kaspersky reports |
|---|---|
| Discovered | June 2026 |
| Target | Android head units with DoFun firmware |
| Delivery | Built-in software updater |
| Payload | Multi-stage downloader |
| Goals | Ad fraud and proxy botnet |
Should drivers be worried?
Not panicked, but aware. There is no sign the malware steals banking details, unlocks the car, or interferes with driving. The risk is more that your vehicle is quietly working a second job for criminals, and that whoever controls the downloader could push new modules later.
If you drive a car with an aftermarket or lesser-known Android infotainment unit, ask the dealer whether DoFun supplies the firmware and whether a clean update is available. Watch for the head unit behaving oddly: overheating when parked, chewing through mobile data, or rebooting without reason.
This is an authentication and supply-chain story more than a driver-error one. The update channel should have required signed packages that the head unit cryptographically verifies before install, the mechanism described in update-security guidance for embedded Android. Where that check is missing or weak, whoever controls the update server controls the car's computer. MFA on driver accounts would not have helped here. Signed firmware and a locked-down update pipeline would have.
