DoFun Vehicle Firmware Targeted by New Ad‑Fraud Malware

Cybersecurity researchers have identified a new malware family specifically designed to compromise the head‑unit firmware of vehicles running DoFun’s Android-based software. The threat was first reported by Kaspersky in June 2026 after investigators noted unusual traffic originating from affected devices ¹. The malware is delivered through the built‑in updater mechanism that ships with DoFun firmware, allowing attackers to push malicious code under the guise of legitimate system maintenance operations ¹.

Once installed, the payload functions as a multi‑stage downloader that ultimately initiates two distinct attack vectors. First, it enables ad fraud by manipulating advertising platforms; second, the malware establishes a proxy botnet that routes outbound requests through compromised head units, potentially supporting large‑scale distributed denial‑of‑service campaigns or covert exfiltration channels ¹.

The infection chain begins when an OTA update package signed with the manufacturer’s key is applied. Because the updater process runs with elevated privileges during boot, attackers can modify the firmware to include hidden backdoor logic. Once executed, the modified binary downloads additional components from a remote server and injects them into the running head‑unit process, ensuring persistence across reboots without leaving obvious traces on disk.

Kaspersky analysts emphasize that this vector is particularly dangerous because many automakers rely on pre‑signed firmware updates to guarantee authenticity. The DoFun case shows that even trusted signing mechanisms can be subverted if the signing authority itself is compromised or if malicious code is introduced before the signing step. As a result, vehicles may inadvertently become part of a global ad‑fraud network while also serving as nodes in a larger proxy botnet capable of routing traffic for external attackers ¹.

From a privacy standpoint, affected users face exposure of personal data such as GPS coordinates, device identifiers, and potentially sensitive usage logs. The botnet component could allow adversaries to use the vehicle’s connectivity to launch attacks against other networks, raising concerns about vehicular cybersecurity beyond the individual owner. Automotive security experts advise manufacturers implement stricter update validation procedures—such as dual signatures or hardware‑based attestation—to prevent tampering with OTA packages ¹.

DoFun head units use a signed updater app installed by default alongside other OEM vehicles using similar methods—this allows attackers access through seemingly legitimate channels. We saw Tesla cars being exploited with phishing attacks leading up to early 2026. The proxy botnet aspect suggests potential DDoS usage beyond ad fraud, as demonstrated by Mirai IoT bots starting around mid‑2016; expect compromised car networks contributing to future large scale outages if not patched promptly. This isn’t unique either: automotive security has been lax since connected infotainment came about.

For consumers vigilance around firmware updates remains crucial. While DoFun has not yet issued an official patch, Kaspersky recommends monitoring anomalous background processes on head units and verifying that any new software comes from reputable sources.