Android malware is spreading through the built-in firmware update mechanism of automotive head units for the first time.