Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of

Report facts: Kaspersky researchers discovered a new malware family in June 2026 targeting Android-based vehicle head unit firmware from DoFun, spreading via built-in update mechanisms to deploy a multi-stage downloader for ad fraud and proxy botnet activity. This shows a compromise of the software update supply chain for embedded Android systems in cars. RealGround analysis: While the reported malware is not an AI model itself, similar supply-chain attacks against Android-based and embedded platforms can propagate into connected AI-driven automotive or mobility systems that rely on those devices for data and connectivity. Organizations using Android or embedded platforms within AI ecosystems should harden update mechanisms, require signed updates, and maintain SBOM-driven monitoring to prevent malicious code from entering AI-related infrastructure.