Vehicular ad hoc networks (VANETs) are expected to play a big role in our lives in the near future; they will both improve traffic safety and revolutionize the driving experience. Their expected deployment in autonomous cars will induce attackers to design new methods to target these systems, and to organize the vehicles they compromise into vehicular botnets. Vehicular botnets enable new attacks that reveal previously unknown security flaws in VANETs. Effectively defending against such botnets requires investigation of their characteristics and of the attacks that these cooperating malicious vehicles can perform on VANETs. One important characteristic of a botnet is the way its members communicate to coordinate their attacks, with an emphasis on stealth. In this paper, we investigate alternatives for vehicular botnets to communicate to perform attacks. We design and demonstrate a VANET-based botnet communication protocol that hides itself in the ongoing network traffic over the control channel. We show via simulation that it is infeasible to detect such botnet communications due to the vulnerabilities existing in the VANET standards, and discuss possible countermeasures.