Kaspersky researchers have identified a new malware family targeting Android-based vehicle head unit firmware developed by DoFun. Discovered in June 2026 and publicly reported in August 2026, the malware spreads through the built-in updaters of the firmware. Its ultimate goal is to serve as a multi-stage downloader enabling ad fraud and the creation of a proxy botnet. The full extent of affected vehicles and exploitation mechanisms remains under investigation.

Which products are affected?

Android vehicle head unit firmware

What should defenders do?

Users and fleet operators with vehicles using DoFun firmware should check for official firmware updates from DoFun or vehicle manufacturers. Apply available security updates. Segregate vehicle infotainment systems from critical vehicle networks where possible. Follow security advisories from Kaspersky and DoFun for further guidance.

highMalware

Kaspersky Identifies Android Vehicle Head Unit Malware Spreading via Built-in Updaters

New malware family targets DoFun firmware to enable ad fraud and proxy botnet recruitment

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Kaspersky Identifies Android Vehicle Head Unit Malware Spreading via Built-in Updaters

Key Takeaways

Kaspersky discovered a new malware family targeting DoFun Android vehicle head unit firmware in June 2026.
The malware spreads through built-in updaters within the firmware.
The ultimate goal is to enable ad fraud and create a proxy botnet.
Affected systems include Android-based vehicle head units using DoFun firmware.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read