Millions of Cars at Risk from New Bluetooth Hacking Technique: What You Need to Know About "PerfektBlue"

Threat Notice Originally Posted on SecurityWeek.com

Cybersecurity isn’t just about computers and phones anymore—it’s moved into the driver’s seat, literally. A newly discovered vulnerability in the Bluetooth software used in millions of vehicles has opened the door for hackers to remotely access sensitive information and potentially even take control of certain systems.

Researchers at PCA Cyber Security have identified several critical flaws in the BlueSDK Bluetooth stack, a software framework developed by OpenSynergy. This stack is used in infotainment systems from major automakers like Mercedes-Benz, Volkswagen, and Skoda, among others.

What’s the Threat?

Dubbed “PerfektBlue,” the threat allows a nearby attacker to pair their device with a car’s infotainment system over Bluetooth and gain high-level access.

In real-world terms, that means a hacker could:

• Track a vehicle’s location

• Access call history and phonebook contacts

• Record audio from inside the vehicle

• In some cases, even move laterally into other systems of the vehicle

And here’s the kicker: in some models, this attack can happen without the driver even knowing. The attacker may only need a single click—or no interaction at all—to gain access.

How the Attack Works

PerfektBlue takes advantage of flaws that allow a hacker to execute code remotely once they’re within Bluetooth range of the vehicle. From there, they can gain control over the infotainment system and, potentially, use that foothold to move into more critical systems, like those controlling steering or braking.

Although researchers have not yet publicly demonstrated attacks on core driving systems using PerfektBlue, earlier hacks (like those involving the Nissan Leaf) have shown how infotainment access can lead to deeper compromise.

This is not just a hypothetical scenario. PCA Cyber Security has already demonstrated the exploit against several car brands and informed OpenSynergy, the developer of BlueSDK, back in May 2024. Patches were issued starting in September 2024, but as of today, many automakers still haven’t deployed the fix.

Why It Matters to Your Business

Many businesses rely on company vehicles or have executives who are frequently on the road. A compromised car is not just a personal risk—it can become a business risk, especially if sensitive calls, contact info, or location data are accessed through the vehicle.

If your team uses vehicles from affected brands—or if you serve high-net-worth individuals or executives—you need to understand the implications.

What You Should Do

Here are the immediate steps we recommend:

• Check for firmware updates on all vehicles, especially infotainment systems.

• Avoid pairing unfamiliar Bluetooth devices, especially in public locations.

• Work with a cybersecurity partner to audit vehicle risks and fleet security protocols.

• If your organization manages a mobile workforce, consider a mobile/vehicle threat assessment as part of your overall security strategy.

Final Thoughts

The PerfektBlue vulnerability is a wake-up call: in today’s world, “connected” means everything is a potential target—from your cloud servers to your company car.

At qnectU, we believe true cybersecurity means protecting every digital doorway—including the ones with wheels.

References 

• https://www.securityweek.com/millions-of-cars-exposed-to-remote-hacking-via-perfektblue-attack/

• https://pcacybersecurity.com/resources/advisory/perfekt-blue

Need help reviewing your risk exposure or understanding if your team is vulnerable?  Schedule a quick 26-minute call with Greg Mauer to discuss your concerns or answer your questions.