BadBox Reaches Car Head Units Through DoFun Updaters
Kaspersky said it found the first malware built specifically for DoFun Android car head units on day 4 of the BadBox campaign, and DoFun patched the updater after notification. The code was delivered through the device’s legitimate update path, not by a separate app install, which moves BadBox further into transportation systems.
The infection works because the head unit trusts its own software-update channel, so the malicious package arrives looking like a normal update and can drop more components after it lands. Kaspersky said the malware is built for ad fraud and reverse-proxy use, so the updater becomes a delivery route for persistent botnet infrastructure as well as nuisance activity.
For operators of Android-based in-vehicle systems, the exposure sits in the trust they place in update infrastructure: if that path is compromised, the vehicle can be enrolled even when nothing suspicious appears on screen. The remaining question is how far beyond DoFun this delivery pattern has spread, because the campaign now shows BadBox adapting its tooling to vehicle infotainment rather than only cheap consumer boxes.