By Ammar Sabilarrohman 
For years, cybersecurity professionals have issued stark warnings about the hidden dangers lurking inside generic, cheap TV streaming boxes sold online. Promising a tempting "all-you-can-stream" buffet of movies, live sports, and premium television for a flat, one-time fee—often bypassing costly subscription services—these devices have flown off the digital shelves of major e-commerce platforms. Yet, security experts have consistently cautioned that consumers are paying a far higher hidden price: secretly renting out their home internet bandwidth to anonymous strangers via pre-installed proxy software.
Now, a groundbreaking and deeply disturbing investigation reveals that the threat goes far beyond simple bandwidth hijacking. New research uncovers that these generic streaming sticks are systematically weaponized to execute sophisticated, automated ad fraud. By spoofing mobile devices and interacting with AI-generated web pages, thousands of compromised TV boxes are siphoning tens of thousands of dollars daily from online merchants and advertising networks, operating completely under the noses of unsuspecting users.
The Main Facts: Anatomy of an Industrial-Scale Cyber Fraud
At the center of this sprawling operation is a popular brand of generic Android streaming devices known as H96. According to a comprehensive technical analysis published by threat researchers at security firm Bitsight, tens of thousands of these devices—plugged into television sets across the globe—are secretly tethered to a malicious enterprise run by a mainland Chinese entity named Zhejiang Fengwo IoT Technology Co., Ltd., which operates under the corporate umbrella of the Fengwo Group.
The scheme relies on a dual-threat mechanism embedded directly into the firmware of the H96 streaming sticks. When a user turns on their television to stream video content, the device quietly functions as a residential proxy node, routing external traffic through the user’s home network. However, the moment the television is turned off—signaled by the loss of an active HDMI connection—the device shifts gears, transforming into an automated bot executing complex ad fraud routines.
Rather than acting like traditional desktop or television browsers, the H96 devices are programmed to spoof mobile phones. Telemetry data captured by security researchers revealed that nearly all of the TV boxes interacting with the operation’s command-and-control infrastructure reported being mobile device models manufactured by prominent brands such as Samsung, Vivo, Huawei, and Xiaomi.
These "phantom" mobile phones are then directed to visit an intricate network of AI-generated websites operated by the Fengwo Group. These fraudulent domains feature machine-generated news articles, financial blogs, health guides, and entertainment trivia designed to mimic legitimate content hubs. Crucially, ads hosted on these pages will only load and display if the visiting device matches the spoofed mobile profile transmitted by the compromised H96 streaming boxes. Once loaded, automated scripts ensure the bots mimic human-like behaviors—navigating pages, managing tabs, and clicking on advertisements to artificially inflate ad revenues.
Chronology of Discovery: Tracking the Fengwo Group
The unraveling of this global ad fraud network reads like a classic digital detective story, spearheaded by Bitsight threat researcher Pedro Falé.
The Expired Domain Breakthrough
The investigation kicked into high gear when Falé registered an expired domain name that had historically been used for telemetry by the H96 streaming ecosystem. This infrastructure was originally designed to periodically collect hardware diagnostics and complete lists of installed applications from tens of thousands of H96 devices worldwide.
Upon seizing control of the domain, Falé began analyzing the incoming telemetry traffic. It was during this deep-dive inspection that the glaring anomaly emerged: thousands of devices explicitly identified as factory Android TV boxes were transmitting data claiming to be high-end mobile smartphones.
Unmasking the Culprits
Digging deeper into the applications driving this behavior, Falé discovered that all reporting devices shared two specific pre-installed apps developed by Zhejiang Fengwo IoT Technology Ltd., a company founded in 2019. Utilizing Bitsight’s proprietary tracking infrastructure, the investigation traced the monetization pathways through a complex web of shell identities based in Hong Kong, Singapore, and single-person corporate entities, ultimately pointing directly back to the mainland Chinese parent group.
Further correlation of SSL certificate data and internal wiki platforms tied the Fengwo Group’s infrastructure directly to the apps found on the H96 devices. The evidence proved conclusive: the Fengwo Group was orchestrating a massive, multi-pronged digital fraud operation that blurred the lines between automated proxy management and programmatic advertising manipulation.
Supporting Data and Technical Architecture: Low-Skill Operators, High-Tech Fraud
One of the most revealing aspects of Bitsight’s analysis is how the Fengwo Group streamlined its operations to maximize output while drastically minimizing technical overhead and labor costs.
The Blockly Weaponization
According to Bitsight, Fengwo Group employees utilized a proprietary implementation of Blockly—an open-source, Google-built visual programming language originally designed to teach children how to write code by dragging and dropping visual blocks.
By employing Blockly, the syndicate allowed low-skilled operators to construct complex ad-fraud execution routines without needing a deep understanding of underlying software engineering. An operator could drag code blocks together to define specific tasks—such as launching a headless web browser, loading an AI-generated URL, scrolling through content, and clicking an ad. Once saved, these visual logic flows were automatically exported as JavaScript and deployed to scalable cloud storage buckets (such as Amazon S3) for distribution to the botnet.
As one Fengwo Group developer remarked in internal documentation uncovered by researchers, this modular approach meant that only a small cohort of elite developers was needed to build core template execution units. Lower-skilled operators could then deploy templates effortlessly, slashing corporate operating costs.
Vision and Reasoning Systems
To bypass sophisticated anti-fraud filters deployed by major advertising networks, the Fengwo Group integrated advanced automation techniques. The H96 bots do not merely click blindly; they fuse multiple vision and reasoning systems into a single interface. This allows the automated scripts to visually identify ad placements on a webpage, interpret layout structures, and navigate the site with human-like timing and randomness, making the fraudulent interactions nearly indistinguishable from genuine user traffic.
Financial Footprint
Based on telemetry data tracking approximately 38,000 active devices connecting to a single, older Fengwo Group domain, Bitsight conservatively estimates that the ad fraud network generates close to $50,000 per day in fraudulent ad revenue. This figure notably excludes the substantial, independent revenue streams generated by renting out the same devices as residential proxies.
When researchers attempted to reach out to the Fengwo Group via the contact address listed on its corporate portal (fwgcloud.com—which proudly boasts of having rented out over 120,000 "AI digital humans" for customer service and companionship), the inquiry bounced back with a telling automated rejection: "Your message couldn’t be delivered… Their inbox is full, or it’s getting too much mail right now."
Official Responses and Industry Implications
The fallout from the Bitsight disclosure has sent shockwaves through the cybersecurity and advertising industries, prompting renewed urgency from law enforcement agencies and consumer watchdogs.
The Regulatory and Law Enforcement Alarm
Federal law enforcement agencies, including the Federal Bureau of Investigation (FBI), have repeatedly issued public safety alerts warning consumers about the grave security risks posed by unverified, internet-connected Internet of Things (IoT) devices. In alerts released over the past year, the FBI emphasized that generic smart home appliances, digital photo frames, and budget streaming boxes are frequently weaponized by cybercriminals to facilitate illegal activities, ranging from distributed denial-of-service (DDoS) attacks to credential stuffing and financial fraud.
Despite these warnings, major global e-commerce titans—including Amazon, Best Buy, Newegg, and numerous online marketplaces—continue to list hundreds of off-brand streaming devices. Frequently hyped by online influencers as miraculous "jailbroken" boxes offering free access to premium entertainment, these products routinely ship pre-infected with malicious software payloads.
The Supply Chain Vulnerability
The security posture of these devices is virtually non-existent. Lacking proper security updates, default authentication mechanisms, or adherence to official Android TV operating system standards, they represent an open invitation for botnet operators. Earlier this year, proxy tracking firm Synthient documented how malicious botnets like Kimwolf successfully enslaved millions of cheap TV boxes by exploiting a cascading series of vulnerabilities in both the pre-installed proxy software and the underlying device firmware.
Furthermore, the advertising ecosystem itself is facing a reckoning. Programmatic ad networks, which rely heavily on accurate metrics to value digital ad space, are losing millions of dollars to non-human traffic generated by AI-driven botnets hiding behind spoofed mobile identities. Advertisers paying top dollar for customer acquisition are effectively burning budgets on invisible synthetic audiences engineered by overseas software syndicates.
Conclusion and Recommendations for Consumers
The revelations surrounding the Fengwo Group and the H96 streaming stick ecosystem serve as a sobering reminder of the adage: If you aren’t paying for the product, you are the product. Devices sold at impossibly low price points while promising unlimited free content are almost invariably subsidized by illicit backend operations that compromise user privacy, consume residential bandwidth, and fuel international cybercrime.
To protect home networks and mitigate exposure to these widespread threats, cybersecurity experts recommend the following defensive measures:
- Stick to Reputable Brands: Consumers should exclusively purchase streaming hardware from established, trusted manufacturers (such as Google, Roku, Apple, Amazon, or major television brands) that maintain strict firmware update policies and official platform certifications (such as Google Play Protect).
- Audit Home Networks: Regularly monitor connected devices using network management tools or router dashboards to identify unknown, generic hardware communicating with suspicious external domains.
- Verify Device Certification: Google provides official support documentation enabling users to verify whether an Android TV device is running legitimate, verified operating system software rather than a cobbled-together open-source clone.
- Consult Threat Intelligence Lists: Organizations like Synthient and various cybersecurity foundations maintain public repositories and blacklists detailing specific consumer IoT brands known to ship with pre-installed residential proxy and botnet software.
As cybercriminals increasingly turn to artificial intelligence, visual programming tools, and automated bot networks to monetize consumer electronics, vigilance remains the first and best line of defense for the modern digital household.
Sagoh 
Evan Lee Salim 