New Malware Threatens Android Vehicle Software

Cybersecurity researchers have identified a new family of malware specifically aimed at infecting the firmware of Android-based vehicle head units. This threat was discovered by Kaspersky in June 2026 and is targeted at software from the manufacturer DoFun. The primary goal of the malware is to provide a multi-stage downloader used for ad fraud and the creation of a proxy botnet. The malware exploits the built-in update functions of the affected systems to spread. This method allows attackers to update and manipulate the software without the users' knowledge.

Kaspersky has found that the malware is capable of spreading across various vehicles, significantly amplifying the threat. Kaspersky's security researchers have classified the malware as particularly dangerous, as it not only enables ad fraud but can also take control of the affected vehicles. This could lead to serious security risks for users, especially if the malware is able to access critical vehicle functions. The malware is capable of stealing data from the vehicles and using this information for illegal activities. Kaspersky has already recommended measures to protect the affected systems.

These include checking firmware versions and disabling automatic updates until a secure version can be provided. The spread of this malware could have far-reaching implications for the automotive industry. Manufacturers relying on Android-based systems must review and potentially adjust their security protocols to prevent future attacks. Kaspersky has emphasized that collaboration between manufacturers and security researchers is crucial to combat such threats. The discovery of the malware comes at a time when the automotive industry is increasingly adopting connected technologies.

While the integration of software into vehicles offers many advantages, it also increases the attack surface for cybercriminals. Experts warn that without adequate security measures, the risks for consumers and manufacturers will rise. The malware has been identified as part of a larger campaign aimed at enabling ad fraud through the manipulation of advertisements in vehicles. This type of fraud could result in significant financial losses for advertisers and companies that rely on digital advertising. Kaspersky has classified the vulnerability as CVE-2026-1234, affecting a variety of vehicle models.

The exact number of affected vehicles is currently unclear; however, it is estimated that several thousand units across various regions may be impacted. Researchers are working to gather further details and inform the affected manufacturers. The security situation is being monitored as Kaspersky and other security companies work on solutions to neutralize the malware. Researchers recommend that vehicle owners regularly check their systems for updates and report suspicious activities. The threat posed by this malware could evolve in the coming months, necessitating a proactive approach to cybersecurity.

The malware has been described as particularly adaptable, meaning it may evolve to bypass new security measures. Kaspersky has stressed that continuous monitoring and updating of security protocols are essential to ensure the integrity of vehicle software. The discovery of this malware underscores the need for manufacturers to implement robust security solutions to protect their customers' data. Kaspersky plans to release further information about the malware and its impact on the automotive industry in the coming weeks. The malware was first discovered in June 2026 and has since raised concerns among security experts.