OT / ICS · 47 days ago
Kaspersky said it found the first malware built specifically for DoFun Android car head units on day 4 of the BadBox campaign, and DoFun patched the updater after notification. The code was delivered through the device’s legitimate update path, not by a separate app install, which moves BadBox further into transportation systems.
The infection works because the head unit trusts its own software-update channel, so the malicious package arrives looking like a normal update and can drop more components after it lands. Kaspersky said the malware is built for ad fraud and reverse-proxy use, so the updater becomes a delivery route for persistent botnet infrastructure as well as nuisance activity.
For operators of Android-based in-vehicle systems, the exposure sits in the trust they place in update infrastructure: if that path is compromised, the vehicle can be enrolled even when nothing suspicious appears on screen. The remaining question is how far beyond DoFun this delivery pattern has spread, because the campaign now shows BadBox adapting its tooling to vehicle infotainment rather than only cheap consumer boxes.
7 sources covering this story
Android Malware Hijacks Update System for Car Head Units
Threat actors behind a click-fraud botnet are targeting vehicle infotainment modules and are abusing legitimate functionality to spread infections.
First Malware Built Specifically for Car Head Units Fuels Botnet
Kaspersky researchers have linked the malware to the BadBox botnet, which has ensnared millions of devices.
The Record from Recorded Future
Hackers infecting Android car systems to build proxy botnet
A new strain of malware is being used to infect Android-based car systems, turning the devices into part of a botnet.
First-known car head unit malware spreads through a legitimate update tool, turning vehicles into nodes in a proxy botnet.
Hackers infect Android car head units with proxy botnet malware
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
New malware abuses DoFun Android head unit updaters to deliver JarService, run ad fraud, and download the Zhima reverse proxy module.
First Android malware targeting automotive head units
Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet.
Part of the PlainSec briefing for 2026-08-27