Investigation Finds Cheap TV Streaming Sticks Spoof Phones to Fuel Vast Ad Fraud Network

Investigation Finds Cheap TV Streaming Sticks Spoof Phones to Fuel Vast Ad Fraud Network A security analysis by Bitsight reveals that generic Android TV streaming sticks, such as H96 models, not only turn home networks into residential proxies but also spoof mobile phone identities to click ads on AI-generated websites, generating an estimated $50,000 per day for an operator based in mainland China. Security firm Bitsight took over an expired telemetry domain communicating with roughly 38,000 H96 streaming sticks worldwide, discovering the devices reported themselves as mobile phones from brands like Samsung, Vivo, Huawei, and Xiaomi. The operation was traced to Zhejiang Fengwo IoT Technology Ltd (Fengwo Group), a mainland Chinese firm that uses low-code Blockly scripts and multi-system vision and reasoning tools to generate fake sites and automate human-like ad clicks. The infected TV sticks alternate their tasks based on HDMI status: acting as residential proxies when the television is in use to preserve performance, and switching to resource-heavy ad fraud jobs when the screen is powered off. Major retailers continue to sell cheap, uncertified Android TV devices, despite recurring warnings from the FBI and security researchers regarding pre-installed malware, botnet enslavement, and proxy relaying. Discovery of Phone Spoofing on H96 Devices Threat researcher Pedro Falé of Bitsight analyzed a captured expired domain formerly used for telemetry by tens of thousands of H96 TV streaming sticks. Rather than reporting as media boxes, the traffic arriving at the domain showed the devices falsely identifying themselves as smartphones made by Samsung, Vivo, Huawei, and Xiaomi. All devices had two specific applications installed, linking back to patents and operations held by Zhejiang Fengwo IoT Technology Ltd, also known as the Fengwo Group, which utilizes corporate shell identities in Hong Kong and Singapore. Blockly-Driven Automation and AI-Generated Targets The Fengwo Group directs the spoofed TV sticks to visit in-house, AI-generated websites containing synthetic text and images across topics such as finance, gaming, and health. These destinations display advertisements only when accessed by devices matching the specific mobile profiles. To orchestrate the scheme with lower labor costs, Fengwo operators use a customized version of Google's Blockly visual programming interface, dragging pre-built code blocks to generate fraud routines that are converted to JavaScript and sent to the streaming sticks. When a stick receives a task, it silently opens a browser, navigates pages, and uses a combination of three vision and reasoning systems to locate and click ads like an authentic human user. Dynamic Switching Between Ad Fraud and Residential Proxies Bitsight observed that the streaming hardware alternates between functioning as a residential proxy node and conducting ad fraud, never running both tasks at the same time. When the hardware detects an active HDMI signal indicating that a consumer is watching video, it operates primarily as a residential proxy to avoid degrading playback performance. Once the television is shut off, the unit transitions back to running the more resource-heavy ad-clicking operations. Risks of Generic Streaming Hardware Bitsight estimates that the single analyzed domain generates roughly $50,000 daily from ad fraud alone, excluding residential proxy revenues. Despite warnings from law enforcement agencies like the FBI, uncertified streaming boxes and other IoT equipment, such as digital photo frames, remain widely available through major online retailers. Security analysts advise consumers to rely exclusively on official Android TV hardware verified through Google Play Protect, as cheap generic devices lack basic authentication, ship with pre-installed proxy backdoors, and frequently fall prey to wider botnets.

安全研究揭露廉价电视盒子沦为广告欺诈肉鸡与住宅代理网络 网络安全机构Bitsight的研究披露，以H96为代表的廉价Android电视盒子不仅被暗中用于出租住宅代理流量，还内置后门伪装成知名品牌手机，在AI生成的虚假网站上自动化点击广告以实施大规模欺诈。 Bitsight通过接管一个过期的遥测域名，发现约3.8万台全球H96电视盒子向后台汇报为三星、vivo、华为和小米等品牌的手机。 欺诈网络由中国大陆实体浙江蜂窝物联网科技有限公司（蜂窝集团）主导，通过香港、新加坡等地的空壳实体进行变现，保守估计日收入近5万美元。 该网络利用可视化编程语言Blockly大幅降低操作门槛，并结合视觉推理系统模拟人类行为点击AI生成网站中的广告。 受害设备具有自适应机制：检测到电视HDMI开启时充当住宅代理，电视关闭时转为运行高资源消耗的广告欺诈任务。 伪装手机的电视盒子与幕后实体 Bitsight研究员Pedro Falé接管了一个用于收集H96电视盒子硬件与应用信息的过期域名后，发现几乎所有连接的设备均伪装成各大厂商的手机。这些设备均预装了浙江蜂窝物联网科技有限公司（蜂窝集团）开发的两款应用，而该公司的专利技术与这些恶意应用机制高度吻合。研究进一步追踪到其利用香港、新加坡及个人空壳身份进行广告欺诈变现。 AI虚假网站与低门槛Blockly模块 蜂窝集团运营着大量涵盖财经、健康、游戏等领域的AI生成网站，这些网站仅在检测到伪装的特定手机配置文件访问时才会展示广告。为降低操作成本，该团伙采用基于Google Blockly的低代码编辑器，让低技能操作员通过拖拽代码块生成欺诈脚本并上传至S3存储桶。电视盒子接收模块后，在后台静默打开浏览器、浏览页面并模拟点击。系统还融合了三套视觉与推理系统，使自动化行为逼近真实人类。 双重运作模式：代理中继与欺诈切换 研究发现H96设备不会同时执行住宅代理和广告欺诈。当设备检测到来自电视的HDMI信号（意味着用户正在观看视频）时，设备仅充当住宅代理；当电视关闭时，才会切换为更消耗资源的广告欺诈任务。Bitsight仅从该单一域名监测到的3.8万台设备估算，其广告欺诈日收益即接近5万美元，尚未计入住宅代理带来的收入。 供应链风险与防范建议 尽管FBI及行业专家屡次预警，主流电商平台仍充斥着预装非官方Android系统的廉价串流设备，甚至部分数码相框等IoT设备也被发现内置代理软件。这些设备缺乏基本认证，极易被Kimwolf等僵尸网络劫持。专家建议消费者购买通过Google Play Protect认证的知名品牌设备，并谨慎安装可能捆绑住宅代理插件的应用。

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. **Pedro Falé** is a threat researcher with the security firm **Bitsight**. Falé told KrebsOnSecurity he was able to peer inside a vast and complex ad fraud network by registering an expired domain name that was used to coordinate fake ad clicks across a particularly popular brand of these streaming devices known as **H96**. Falé said the domain he scooped up was previously used for telemetry, periodically collecting full hardware information and the entire list of installed apps from tens of thousands of H96 streaming sticks plugged into television sets around the globe. But upon inspecting the traffic being funneled to the domain, he discovered nearly all of the TV boxes transmitting data claimed to be mobile phone models from a variety of manufacturers, including Samsung, Vivo, Huawei, and Xiaomi. “We noticed something was wildly wrong,” Falé said. “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.'” The researcher found all of the devices reported having the same two apps installed, and that those apps were made by a company called **Zhejiang Fengwo IoT Technology Ltd**, an entity founded in 2019 in mainland China which operates an ad-publishing portfolio under the name **Fengwo Group**. Further investigation into the Fengwo Group revealed it has registered multiple patents that match the inner workings of these apps. “Bitsight TRACE identified several Hong Kong, Singapore, and single person ‘legal’ shell identities used to collect the monetization and traced the operation back to a mainland China company known as Zhejiang Fengwo IoT Technology Co., Ltd, which operates under the Fengwo Group,” Falé [wrote](https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks) in a report released today about their findings. Falé said an analysis of the apps shows they help to coordinate an ad fraud network that uses these H96 devices as a captive traffic source to click on ads at AI-generated websites operated by the Fengwo Group. Bitsight discovered the websites contain machine-generated news articles and graphics across a range of categories, including finance, health, education, gaming, music and food blogs. But they also found none of those sites displayed ads unless the device visiting the page matched the spoofed mobile profile of these H96 devices. The domain for the Fengwo Group — fwgcloud\[.\]com — claims the company is “redefining the boundaries of human-AI interaction,” and that it has created more than 120,000 “AI digital humans” available to rent for everything from emotional companionship to 24/7 customer service and creative design. Falé said the Fengwo Group’s domain shared its SSL certificate data with other domains associated with the apps found on H96 devices, specifically the phone spoofing mechanism. He noted the domain also has an internal wiki platform that directly ties the Fengwo Group to a proprietary implementation of a Google-built visual programming language called **Blockly**, which was originally designed to help kids learn how to write software. According to Bitsight, the Fengwo Group’s employees use Blockly to build the sham websites, allowing low-skilled operators to drag blocks of code together in their Blockly editor — without any need to understand what the underlying code blocks do or how they work. “An operator can drag blocks together in their Blockly editor, to define each fraud routine, given a task type,” reads Bitsight’s report. “Once the routine is saved, it gets exported as JavaScript and uploaded to the S3 buckets. An operator doesn’t need as much understanding of the underlying technicalities, as it is all set in place for ease of use.” Bitsight even found one of the Fengwo Group app developers mentioning exactly these advantages, noting the developer remarked that “only a small number of highly-skilled developers are needed to build the template execution-unit images,” and that “developers who create execution units from those templates have significantly lower technical requirements, greatly reducing the company’s operating costs.” Falé said if a user’s H96 streaming stick is selected for a specific fraud task, it will be pushed the appropriate Blockly module according to the task desired, which can include silently launching a web browser, visiting websites, browsing pages, managing tabs, and clicking on ads. To ensure the TV boxes masquerading as mobile phones can reliably click on ads displayed via the AI-generated websites, the Fengwo group “fuses three vision and reasoning systems into a single interface,” allowing the bots to correctly identify an ad on the webpage and navigate the site much like a human would, the Bitsight report observed. Bitsight found the H96 devices were either relaying residential proxy traffic or participating in ad fraud, but never both at the same time. In fact, they concluded that when these TV boxes detect an HDMI signal from an attached television — indicating the user intends to stream video content — the box is usually functioning as a residential proxy. When the TV is off, it switches back to waiting for ad fraud jobs. Falé said he believes the TV boxes are set up this way because its ad fraud activities are far more resource intensive and could interfere with the device’s stated purpose — streaming video content over the Internet. Despite repeated [warnings from the FBI](https://www.fbi.gov/investigate/cyber/alerts/2025/home-internet-connected-devices-facilitate-criminal-activity) and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands that bundle unofficial versions of Google’s Android operating system and are frequently marketed ([via online influencers](https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/)) as a way to access a broad array of streaming services and live broadcasts without a subscription. In addition to enlisting the user’s TV box in ad fraud networks, these off-brand streaming devices almost universally come with **residential proxy** software pre-installed. This software rents the user’s Internet address out to anonymous paying customers, who run the gamut from aggressive content scraping firms to ticket scalpers and outright cybercriminals. What’s more, because these generic (and generally dirt cheap) TV boxes are all horribly insecure by default and bereft of any kind of authentication, installing one on your home or office network only invites further mischief. In January, the proxy tracking service **Synthient** documented how multiple botnets had [rapidly enslaved millions of TV boxes](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/) using a complex interplay of security vulnerabilities in both the residential proxy software and the streaming devices themselves. Bitsight said it tracked approximately 38,000 TV boxes globally phoning home to the expired Fengwo Group domain, and based on that number the report estimates this ad fraud network brings in revenues of close to $50,000 a day (not counting substantial revenue from the residential proxy side of the business). However, Falé emphasized that these estimates are highly conservative and based on telemetry from just one of the Fengwo Group’s core (but older) domains. As for the Fengwo Group’s claim to have 120,000 “digital humans” at their disposal, Bitsight’s report concludes it could be just a clever marketing scheme and/or a way to avoid drawing suspicion to the company’s operations. “Historically, when dealing with proxy services or DDoS, we sometimes see these websites undertake inconspicuous facades, so as not to advertise their DDoS capability or botnet size,” Falé wrote in the report. “This could also be the case here.” If the Fengwo Group truly does have tens of thousands of “AI humans” at its beck and call, it does not appear to have dedicated any of them to fielding inquiries from its own website. KrebsOnSecurity sought comment from the Fengwo Group by emailing the contact address listed on the company’s homepage, but the request bounced back with the reply, “Your message couldn’t be delivered to postmaster@fwgcloud\[.\]com. Their inbox is full, or it’s getting too much mail right now.” As Bitsight’s analysis shows, when it comes to TV boxes and streaming sticks, it’s best to stick to name brands from reputable manufacturers, and then to be sparing and careful with any apps you choose to install on the device — as [many of those can bundle residential proxy software as well](https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/). Google says consumers can confirm whether or not a device is built with the official Android TV OS and Play Protect certification by following [these instructions](https://support.google.com/googleplay/answer/7165974). Additionally, Synthient maintains [a running list of IoT devices](https://github.com/synthient/public-research/blob/main/2026/01/kimwolf/product_names.csv) that have been known to ship to consumers with residential proxy software and other malicious apps pre-installed. Careful readers will notice Synthient’s list includes other IoT devices apart from streaming sticks and boxes: As the FBI has warned, residential proxy software has also been found in other popular consumer IoT devices from random brands, particularly digital photo frames.