The Silent Hijack: How Your "Unlimited" TV Box Became a Global Fraud Engine

For years, security researchers have warned that the bargain-bin streaming boxes promising "unlimited content" for a one-time fee were too good to be true. These generic, low-cost devices—often sold on major e-commerce platforms—have long been suspected of harboring backdoors that turn residential home networks into unwitting relay stations for strangers.

However, a groundbreaking investigation by the security firm Bitsight has unveiled a far more sinister reality. These devices are not merely passive proxies; they are active participants in a sophisticated, automated ad-fraud empire. By spoofing mobile phone identities and simulating human behavior, tens of thousands of these TV boxes are quietly clicking on advertisements across AI-generated websites, siphoning millions of dollars from the digital advertising ecosystem.

The Discovery: Peering Into the Backdoor

The investigation began with a stroke of forensic luck. Pedro Falé, a senior threat researcher at Bitsight, discovered an expired domain name that had previously served as a command-and-control hub for the H96 brand of streaming devices. By registering the domain, Falé gained an unprecedented vantage point into the telemetry data being funneled from thousands of devices worldwide.

What he found was a digital identity crisis. While the devices were physically plugged into living room televisions, their internal telemetry reported them as mobile smartphones—specifically, models from major manufacturers like Samsung, Vivo, Huawei, and Xiaomi.

"We noticed something was wildly wrong," Falé told KrebsOnSecurity. "Multiple devices reporting to this factory Android TV Box backdoor were claiming to be mobile phones."

Further analysis revealed that every one of these devices shared the same two pre-installed applications. These apps were traced back to a mainland China-based entity known as Zhejiang Fengwo IoT Technology Ltd, operating under the broader "Fengwo Group." This wasn’t just a glitch; it was a carefully engineered mechanism designed to trick ad-tracking systems into believing they were serving ads to high-value mobile users rather than stationary, non-human TV boxes.

Chronology of a Fraud Empire

The operational maturity of the Fengwo Group suggests a long-term strategy rather than a fly-by-night operation.

• 2019: Zhejiang Fengwo IoT Technology Ltd is founded in mainland China, beginning the development of its software portfolio.
• The Build Phase: The group registers multiple patents that align perfectly with the obfuscation techniques found in their apps, creating a "legal" framework for their monetization efforts.
• The Deployment: Generic H96 TV boxes are manufactured and distributed globally. These devices are shipped with pre-installed, non-removable software that acts as a dual-purpose tool: a residential proxy relay and a botnet agent for ad fraud.
• Present Day: Bitsight researchers identify approximately 38,000 active devices connected to a single core domain. The fraud network now operates with high efficiency, utilizing AI-generated content to capture ad revenue.

The Mechanics of Deception: AI and Blockly

The sophistication of the Fengwo Group’s operation lies in its modular design. The group utilizes a proprietary implementation of Google’s "Blockly"—a visual programming language originally intended to teach children how to code. By using a drag-and-drop interface, low-skilled operators can define fraud routines without needing to understand the underlying JavaScript.

Once a routine is built, it is exported as a module and pushed to the H96 devices. The device then silently launches a browser, navigates to an AI-generated website, and begins the process of "viewing" content. To ensure the fraud remains undetected by ad networks, the system incorporates advanced vision and reasoning software. This allows the bot to "see" the page, identify where advertisements are located, and navigate the interface in a manner that mimics human behavior, such as scrolling, clicking, and tabbing.

The websites themselves are masterpieces of hollow automation. Bitsight found that these sites cover every imaginable niche—finance, health, gaming, music, and food blogs—all populated with machine-generated articles and graphics. Crucially, these sites only display ads when they detect the spoofed mobile identity of an H96 device, effectively hiding the fraud from casual human observers or automated security crawlers.

The Dual-Life Cycle: TV vs. Botnet

Perhaps the most ingenious aspect of the Fengwo operation is its resource management. The H96 devices are programmed to operate in two distinct modes based on user activity:

1. The Proxy Phase: When the device detects an HDMI signal (indicating the owner is actively watching TV), the device functions as a residential proxy. It leases the user’s home internet connection to external parties, likely for data scraping or cybercriminal activity.
2. The Fraud Phase: When the TV is turned off, the device shifts gears. It enters a high-intensity mode, launching the ad-fraud routines that would otherwise compete for system resources and disrupt the user’s viewing experience.

By alternating these roles, the Fengwo Group ensures that the user is less likely to notice their device is underperforming or behaving suspiciously, thereby extending the "lifespan" of the infected device.

The Economic Implications

The scale of this operation is staggering. Bitsight estimates that the 38,000 devices tracked under just one Fengwo domain generate approximately $50,000 in revenue daily. This figure excludes the revenue generated from the residential proxy side of the business, which serves a separate customer base of scrapers and bad actors.

This revenue is laundered through a web of shell identities across Hong Kong, Singapore, and individual straw-man entities. The result is a highly profitable, low-overhead enterprise that leverages the global supply chain of cheap electronics to victimize the digital advertising industry.

Official Responses and Industry Warnings

Despite repeated alerts from the FBI regarding the security and privacy risks of "no-name" IoT devices, the market for these streaming sticks remains robust. Major e-commerce giants continue to list them, often marketed by online influencers as a way to "cut the cord" and bypass subscription fees.

Google has attempted to mitigate this by encouraging consumers to verify whether their devices are certified with the official Android TV OS and Play Protect. However, the sheer volume of uncertified, "off-brand" devices flooding the market makes enforcement difficult.

In a ironic turn, when KrebsOnSecurity attempted to reach the Fengwo Group for comment via the contact address listed on their official website, the message bounced back. The server replied that the inbox was either full or receiving too much traffic—a fittingly automated response for a company built entirely on the illusion of human activity.

The Broader Danger: Your Home as a Node

The implications of this research extend far beyond ad fraud. By purchasing these devices, consumers are effectively inviting a persistent, foreign-controlled botnet into their most private spaces.

As the security service Synthient documented in early 2026, millions of these boxes have been enslaved by a "Kimwolf" botnet, which exploits the inherent lack of authentication in these devices to move laterally through local networks. If a device can spoof a mobile phone to defraud an ad network, it can just as easily be used to scan a home network, compromise other IoT devices, or exfiltrate private data.

The "smart" home, in this context, has become a liability. Digital photo frames, smart cameras, and streaming sticks often share the same insecure software architecture, creating a sprawling surface for attackers.

Conclusion: A Call for Digital Hygiene

The Bitsight report serves as a definitive wake-up call. The era of "plug-and-play" streaming without regard for the origin of the hardware is over. Consumers are urged to:

• Avoid Generic Brands: Stick to reputable manufacturers who provide long-term firmware updates and security support.
• Check for Certification: Use Google’s official tools to ensure your Android TV device is certified.
• Audit Your Network: Regularly check connected devices and, if possible, isolate IoT devices on a guest network to prevent them from accessing personal computers or storage devices.
• Be Skeptical of "Free": If a device promises unlimited, free access to paid content, it is almost certainly monetizing your network or your personal data in ways that are detrimental to your security.

The Fengwo Group’s "AI digital humans" may be a clever marketing ploy to distract from their botnet, but the threat they pose is entirely real. As long as these insecure devices remain in our homes, we are all unknowingly subsidizing a global network of digital crime. The solution lies not just in better security software, but in a fundamental change in how we evaluate the "smart" technology we bring into our living rooms.