Aftermarket Android car head units from brands like DoFun keep getting caught shipping ad bots and click fraud malware straight from the factory. If you already installed one, wiping it is not always an option, and Google Play Protect on the dashboard is patchy at best. These seven Android apps make the head unit a lot less useful to whoever is running the ad fraud, without turning your dashboard into a phone.
What to look for in a head unit security app
Head units are a strange environment:
- Do you have Play Store access on the unit, or does it need APK sideloading?
- Is there any real filesystem, or is it locked down?
- Does the app work without granting device admin rights?
- Can it block outbound traffic from system apps you cannot uninstall?
- Does it survive the reboot the unit does every time you turn the ignition?
Quick comparison
| App | Best for | Free plan | Paid | Standout |
|---|---|---|---|---|
| Malwarebytes Mobile Security | Cleaning known malware families | Yes | $12/yr | On-demand scan without device admin |
| Bitdefender Mobile Security | Continuous scanning that survives reboots | Trial | $15/yr | Auto-scan on install |
| AdGuard for Android | Blocking ad requests at the DNS or VPN layer | Yes | $30/yr lifetime | Works without root, no dependency on browsers |
| NetGuard | Per-app firewall for outbound traffic | Yes | Optional | Blocks system apps you cannot uninstall |
| NextDNS | Encrypted DNS with block lists | Free tier | $2/mo | One profile covers every request the unit makes |
| Warden | Detecting trackers baked into system apps | Yes | Free | Reads Exodus and TrackerControl databases |
| Tracker Control | Live view of every outbound tracker call | Yes | Free | Open source, no analytics of its own |
The apps
1. Malwarebytes Mobile Security — best for cleaning a compromised head unit
Malwarebytes Mobile Security is the safest first move on a suspicious head unit. Install it, run a full scan, and it flags the known ad-fraud families that ship on DoFun and similar units. The free tier does the scan and quarantine without any subscription push.
Where it falls short: Continuous protection and web filtering need the paid tier. Some head units strip Play Protect and refuse to install signed packages, so sideload the APK if the Play Store is missing.
Pricing: Free scanner. Premium: $12 per year for one device.
Platforms: Android 5.0 and up.
Download: Malwarebytes for Android on Aptoide or from Google Play.
Bottom line: The first thing to install on any head unit you did not personally flash.
2. Bitdefender Mobile Security — best for continuous scanning
Bitdefender Mobile Security watches every install and every process wake. When a system-app OTA drops a new payload, Bitdefender flags it before it can register a boot receiver. That is the pattern the DoFun ad bots use, and it is what most one-shot scanners miss.
Where it falls short: Requires a paid subscription past the trial. Some anti-theft features need permissions that a head unit will not have (SIM, camera, location).
Pricing: 14-day trial. Bitdefender Mobile Security: $15 per year.
Platforms: Android 5.0 and up.
Download: Bitdefender Mobile Security on Aptoide
Bottom line: Pair with a firewall for a defense-in-depth setup that survives OTAs.
3. AdGuard for Android — best for blocking the ads that fund the malware
AdGuard for Android runs as a local VPN, filters DNS, and blocks the requests that ad-fraud malware makes to load creatives. On a head unit, that turns the ad bot into a network operation with no revenue, which is often enough to make it stop trying.
Where it falls short: The local VPN interferes with Android Auto’s own VPN when a passenger is casting. Turn it off during Auto sessions or use DNS mode instead.
Pricing: Free ad blocking in AdGuard’s own browser. AdGuard for Android premium: about $30 per year, or a lifetime license around $80.
Platforms: Android 5.0 and up.
Download: AdGuard for Android on Aptoide
Bottom line: The most effective daily defense against dashboard ad networks.
4. NetGuard — best per-app firewall without root
NetGuard is the open-source firewall the community keeps recommending. It creates a local VPN loop and blocks any app from making outbound calls unless you allowed it. On a head unit riddled with unknown system apps, that is the difference between an infected unit and a quiet one.
Where it falls short: VPN loop uses a small amount of battery, though on a head unit that runs on the car’s alternator it does not matter. Full outbound logging needs the paid pro upgrade.
Pricing: Free. Pro features: one-time small in-app purchase.
Platforms: Android 5.1 and up.
Download: NetGuard on F-Droid
Bottom line: The correct tool when you cannot remove the malicious system apps.
5. NextDNS — best for a network-wide encrypted DNS filter
NextDNS runs upstream of the head unit and blocks queries to known ad-fraud, tracker, and malware domains. One profile applies across every device on your Wi-Fi hotspot or car SIM, so the head unit gets protection even when a specific app skips the VPN.
Where it falls short: Free tier caps at 300,000 queries per month, which a busy dashboard can approach. Setting up DNS-over-TLS on a head unit needs Android 9 or later.
Pricing: Free tier up to 300K queries per month. Paid: $2 per month or $20 per year.
Platforms: Android 9 and up (via Private DNS setting), any Android via the NextDNS app.
Download: NextDNS on Aptoide
Bottom line: The lowest-friction way to filter the whole unit at once.
6. Warden — best for auditing trackers in preinstalled system apps
Warden reads the Exodus Privacy and TrackerControl databases and shows exactly which trackers each app on the head unit ships with. That is how you find the ad SDK a factory app was compiled against, even before it fires a single request.
Where it falls short: Read-only. Warden reports what is there; blocking is up to another tool. Some heavily obfuscated system apps do not match any database entry.
Pricing: Free.
Platforms: Android 5.0 and up.
Download: Warden on Aptoide
Bottom line: The audit tool to run before you decide which firewall rules to write.
7. Tracker Control — best live view of dashboard outbound traffic
Tracker Control is a research project from the University of Oxford that runs as a local VPN and displays every outbound tracker call from every app in real time. On a head unit, it exposes the specific hosts a factory app is trying to reach.
Where it falls short: Not as polished as commercial products. Some Android Auto services throw errors under the VPN loop.
Pricing: Free, open source.
Platforms: Android 5.1 and up.
Download: Tracker Control on F-Droid
Bottom line: The right tool for anyone who wants to see the malware in the act.
How to pick the right one
- If you suspect an infection right now: Malwarebytes for the scan, NetGuard to cut the calls.
- If you already installed a suspect unit: Bitdefender for continuous watch plus Warden for the audit.
- If you have no interest in per-app work: NextDNS on the network the unit uses.
- If you already run ad-blocking on your phone and want it on the dash: AdGuard for Android.
- If you want to see exactly what is happening: Tracker Control while you drive.
FAQ
Are aftermarket Android head units really shipping with malware? Yes. Security researchers have documented DoFun and a handful of other budget units shipping preinstalled ad-fraud code straight from the factory in 2026. It is common enough that mainstream press has covered it.
Can I just uninstall the malicious app? Sometimes. When it is baked into /system (which is most of the time), uninstalling requires root, so a firewall or DNS filter is a better answer.
Do these apps drain the car battery? Head units run on ignition power. Once the car is off, they cut out. Battery drain is not the same concern as on a phone.
Will Android Auto still work with a firewall installed? Usually. NetGuard and AdGuard both allow whitelisting of Auto services. Test one route before you rely on it.
Do I need root on the head unit? No. Every app in this list works without root. Root would let you remove offending system apps outright, but that is a separate exercise.
Is this a real risk or an overblown story? The units are cheap, ship in high volume, and phone home to real ad networks. Sample sizes in academic papers show measurable ad-fraud revenue per unit. The risk is real, but it is more about ad revenue theft and traffic than personal data leakage.
