For years, cybersecurity researchers and consumer advocacy groups have sounded the alarm over the hidden dangers of generic, unbranded streaming TV boxes. These cheap devices, which promise users unlimited access to live broadcasts, pay-per-view events, and massive content libraries for a single, low, one-time fee, have long been suspected of harboring malicious utility. Warnings have repeatedly highlighted how these gadgets secretly rent out an unsuspecting owner’s home internet connection to anonymous third parties as residential proxies. However, a groundbreaking and exhaustive new analysis has uncovered a far more sinister and complex operation running silently in the background: these devices routinely spoof themselves as mainstream mobile phones to systematically click on advertisements hosted across a sprawling network of artificial intelligence-generated websites, defrauding online merchants and global advertising networks on an industrial scale.
The scope of this vast operation was brought to light by Pedro Falé, a threat researcher with the prominent cybersecurity firm Bitsight. Falé detailed to investigative journalist Brian Krebs how he managed to peer directly inside the mechanics of this complex ad fraud machinery. The breakthrough occurred almost by accident when Falé registered an expired domain name that had previously been utilized to coordinate fake ad clicks across a remarkably popular brand of generic streaming devices known as H96. These inexpensive TV sticks, easily found on major e-commerce platforms, were quietly phoning home to this very infrastructure, unaware that the domain’s ownership had changed.
Upon inspecting the telemetry data and the massive volumes of traffic being funneled into the newly acquired domain, Falé discovered a glaring anomaly. The domain had originally been configured for telemetry, periodically harvesting full hardware profiles and comprehensive lists of installed applications from tens of thousands of H96 streaming sticks plugged into television sets around the globe. Yet, an analysis of the incoming connections revealed that nearly all of the TV boxes transmitting data were claiming to be mobile phone models manufactured by prominent tech companies, including Samsung, Vivo, Huawei, and Xiaomi.
The realization struck the researcher immediately. Multiple devices reporting directly to a factory Android TV box backdoor were presenting themselves to the network as mobile smartphones. Upon deeper inspection, Falé found that every single one of these compromised streaming devices reported having the exact same two applications installed. Tracing the origin of these applications led directly to a mainland Chinese entity founded in 2019 known as Zhejiang Fengwo IoT Technology Ltd, which operates an extensive portfolio of ad-publishing networks under the umbrella of the Fengwo Group. Further scrutiny by Bitsight revealed that the Fengwo Group had registered multiple patents that matched the exact inner workings and behavioral patterns observed within the malicious apps.
Through advanced threat intelligence tracking, Bitsight identified a web of shell identities based in Hong Kong, Singapore, and single-person legal entities that were being utilized to collect monetization revenues from the scheme. The trail ultimately led back to the parent company in mainland China. An analysis of the applications deployed across the H96 devices showed that they functioned as the core coordination mechanism for an ad fraud network. This network leveraged the captive traffic source of tens of thousands of residential TV boxes to systematically load and click on advertisements hosted on AI-generated websites operated by the Fengwo Group.
Bitsight’s investigation into these web properties revealed a sophisticated automation pipeline. The websites themselves contained machine-generated news articles, blog posts, and graphics spanning a diverse range of categories, including finance, health, education, gaming, music, and food. Crucially, the researchers discovered that none of these sites would display advertisements unless the visiting device matched the specific, spoofed mobile profile associated with the compromised H96 streaming sticks.
AI Digital Humans and Low-Skill Fraud Operations
The primary domain utilized by the Fengwo Group, fwgcloud[.]com, projects a futuristic façade, claiming on its homepage that the company is actively redefining the boundaries of human-AI interaction. The platform boasts of having created more than 120,000 artificial "digital humans" available for rent for a variety of tasks, ranging from emotional companionship and 24/7 customer service to creative design. However, the technical underpinnings discovered by Bitsight tell a very different story of automated deception.
Technical analysis revealed that the primary Fengwo Group domain shared its SSL certificate data with other domains directly associated with the fraudulent applications discovered on the H96 devices, specifically tying them to the mobile phone spoofing mechanism. Furthermore, the domain featured an internal wiki platform that linked the organization directly to a proprietary implementation of Blockly, an open-source visual programming language originally built by Google to help children learn the basics of computer programming by snapping visual blocks together.
According to Bitsight’s findings, employees and operators within the Fengwo Group utilize Blockly to rapidly construct and deploy their network of sham websites and fraud execution routines. This visual interface allows low-skilled operators to drag blocks of code together in an editor without requiring any deep understanding of the underlying programming logic or technical execution. Once a routine is saved, it is automatically exported as JavaScript code and uploaded to cloud storage buckets. As a result, the company significantly reduces its operational costs, requiring only a small cadre of highly skilled developers to build the core template execution units while cheaper, less experienced labor handles the day-to-day deployment of fraud tasks.
When an H96 streaming stick is selected for a specific fraud routine by the command-and-control infrastructure, it receives the appropriate Blockly module. This module can silently launch a background web browser, navigate to targeted AI-generated websites, browse through pages, manage multiple tabs, and ultimately execute clicks on advertisements. To ensure that these TV boxes—masquerading as mobile phones—can reliably interact with web pages and click on ads just like human users, the Fengwo Group integrates multiple vision and reasoning systems into a single interface. This allows the automated bots to accurately identify ad placements on a webpage and navigate the site naturally, evading standard fraud detection filters employed by advertising networks.
TV On? Proxy. TV Off? Ad Fraud
One of the most intriguing discoveries made by Bitsight researchers was the operational dichotomy governing the behavior of the compromised H96 devices. The investigation revealed that the streaming sticks were either utilized to relay residential proxy traffic or participate in ad fraud, but never both simultaneously. Investigators concluded that when these TV boxes detect an active HDMI signal from a connected television set—signaling that the user is actively watching video content or streaming a show—the box prioritizes its primary function and operates as a residential proxy. However, the moment the television is turned off, the device immediately switches modes, returning to a standby state where it awaits instructions to execute ad fraud tasks.
Researchers believe this operational split is intentional. The ad fraud activities managed by the Fengwo Group are significantly more resource-intensive and could easily degrade the performance of the streaming device, potentially interfering with its primary, advertised purpose of streaming video content over the internet and arousing suspicion from the user.
Despite repeated, high-profile warnings issued by the Federal Bureau of Investigation and cybersecurity leaders regarding the inherent security and privacy risks tied to unbranded streaming devices, major e-commerce marketplaces—including Amazon, Best Buy, Newegg, and numerous others—continue to host and sell hundreds of different models and brands. These devices frequently bundle unofficial, modified versions of Google’s Android operating system and are aggressively marketed, often through online influencers, as cost-effective alternatives to official streaming hardware that promise free access to premium entertainment and live broadcasts without subscriptions.
Beyond enlisting unsuspecting users’ hardware into sophisticated ad fraud botnets, these generic and inexpensive streaming boxes almost universally arrive with residential proxy software pre-installed at the factory level. This software silently rents out the owner’s home internet IP address to anonymous third-party buyers whose activities span the entire digital underworld, ranging from aggressive web-scraping outfits and automated ticket scalpers to outright cybercriminals engaged in credential stuffing and financial fraud.
Compounding the issue is the fact that these cheap streaming devices are typically plagued by severe security vulnerabilities and lack basic authentication mechanisms by default. Consequently, plugging one into a home or office corporate network opens the door to broader compromise. Earlier in the year, proxy tracking service Synthient documented how multiple large-scale botnets successfully enslaved millions of similar TV boxes by exploiting complex vulnerabilities residing in both the pre-installed proxy software and the underlying device firmware.
Scale of the Operation and Consumer Guidance
Bitsight’s telemetry tracking indicated that approximately 38,000 individual TV boxes globally were actively phoning home to the expired Fengwo Group domain alone. Based on this conservative baseline, researchers estimate that this specific ad fraud network generates close to $50,000 a day in illicit revenue, a figure that excludes the substantial profits generated from the residential proxy side of the business. Furthermore, researchers emphasize that these estimates reflect telemetry gathered from only a single, older domain controlled by the organization, meaning the true global footprint of the operation is likely much larger.
Regarding the Fengwo Group’s claims of possessing 120,000 digital humans ready for deployment, Bitsight’s report concludes that this assertion is likely a clever marketing smokescreen designed to obfuscate the true nature of the infrastructure and deflect suspicion from their botnet operations. Historically, operators running large-scale proxy networks or distributed denial-of-service infrastructures frequently adopt benign or high-tech corporate facades to hide the actual size and capability of their networks. Attempts by media outlets to contact the Fengwo Group for comment via the email address listed on their official homepage resulted in delivery failure notices, with mail server responses indicating that the inbox was either completely full or overwhelmed by incoming traffic.
Security experts reiterate that consumers seeking to avoid these risks should exclusively purchase streaming hardware from reputable, well-known manufacturers and exercise extreme caution when installing third-party applications, as many unofficial apps have also been found to bundle residential proxy software. Google maintains that consumers can verify whether a device runs the official, certified Android TV operating system and includes Play Protect verification by consulting official support documentation.
Additionally, threat intelligence firms like Synthient maintain public repositories tracking internet-connected devices known to ship with pre-installed proxy software and malicious payloads. Security agencies continue to remind the public that these threats extend beyond television streaming boxes, noting that similar malicious proxy software has frequently been discovered pre-loaded into other popular, unbranded consumer Internet of Things devices, particularly digital photo frames and smart home accessories.
