[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0qi6-BI9cDsFkpcPYCxGlZ4C4GuZDLF0OFR-pKHbYzQ":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"dc044cb9-a422-432a-b405-7a1102aa0cf4","Android Malware Hijacks Update System for Car Head Units","android-malware-hijacks-update-system-for-car-head-units-8e8e94","Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread infections.","A click-fraud botnet has evolved its tactics to target Android-based car head units. Threat actors are exploiting the legitimate update mechanism of these systems to distribute malware, potentially leading to widespread infections within vehicles.","Android malware targets car head units by hijacking update systems.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fandroid-malware-hijacks-update-system-car-head-units","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltc461573f3500ab14\u002F6a8f24afbec2b8b5acf318e4\u002Fcarheadunit-AndreyPopov-Getty-2241387705.jpg?width=720&quality=80&disable=upscale","2026-08-26T17:33:45+00:00","2026-08-26T20:00:18.245402+00:00",7,[17],{"name":18,"type":19},"Android","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":128},[42,70,99],{"slug":43,"name":44,"problem":45,"products":46},"patch-management","Automated patch management","Known holes get closed in days, not months.",[47,55,62],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":43,"product_name":59,"url":60,"description":61},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":71,"name":72,"problem":73,"products":74},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":100,"name":101,"problem":102,"products":103},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[129],{"slug":130,"name":131,"logo_path":132,"roles":133},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"car-head-unit-malware-hijacks-legitimate-update-mechanism","Car Head Unit Malware Hijacks Legitimate Update Mechanism","Threat actors exploited the trusted update system of Android-based car head units to silently distribute click-fraud malware, turning a security feature into an attack vector. This highlights the danger of insufficiently authenticated or unverified software update pipelines, especially in embedded and IoT-adjacent systems. The automotive sector is increasingly reliant on connected software, yet update integrity controls often lag behind traditional IT standards. A compromised vehicle head unit can serve as a persistent botnet node, exposing both vehicle owners and broader networks to ongoing fraud and potential data exfiltration.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-193: Platform Firmware Resiliency Guidelines","NIST SI-7: Software, Firmware, and Information Integrity","NIST SA-12: Supply Chain Protection","NIST CM-6: Configuration Settings","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","UNECE WP.29 R155: Cyber Security Management System for Vehicles","ITIL Change Management: Controlled Software Update Procedures",{}]