By Nana Muazin 
By Global Tech Security Desk
Published: July 2026
For years, cybersecurity professionals have raised blaring alarms regarding the hidden costs of bargain-bin TV streaming boxes. These ubiquitous, generic devices—often marketed aggressively across mainstream e-commerce platforms like Amazon, Best Buy, and Newegg—promise users a tempting shortcut: unlimited, unmetered access to premium content, live sports, and global television channels for a single, dirt-cheap, up-front fee.
Yet, security researchers have long warned that these uncertified gadgets carry a sinister trade-off, secretly commandeering residential internet connections to route traffic for anonymous third parties.
Now, a groundbreaking and exhaustive analysis by threat intelligence firm Bitsight reveals that the threat is far more sophisticated—and far more lucrative—than previously understood. Beyond merely laundering internet traffic, tens of thousands of popular generic TV streaming boxes are actively weaponized as part of a massive, automated ad-fraud apparatus. Operating with chilling precision, these devices systematically spoof mobile operating systems, visit AI-generated fake websites, and simulate human behavior to defraud digital advertising networks and online merchants of millions of dollars.
Main Facts: Inside the Anatomy of the H96 Botnet
The investigation, spearheaded by Bitsight threat researcher Pedro Falé, exposes a sprawling underground operation orchestrated by mainland Chinese entities, shell corporations in Hong Kong and Singapore, and automated code-generation pipelines.
At the center of the storm are devices like the H96 series, a popular brand of Android TV boxes widely available to global consumers. According to Bitsight’s findings, these devices do not merely arrive with insecure software; they are systematically shipped pre-infected with specialized modules designed to switch between dual malicious functions depending on whether a television set is powered on or off.
When a user sits down to watch television—signaled by an active HDMI connection—the H96 device typically pivots into a residential proxy node, quietly renting out the user’s home IP address to unknown buyers who utilize the connection for aggressive web scraping, ticket scalping, or covert cyber operations.
However, the moment the television is turned off, the streaming box drops its proxy duties and shifts gears into an intensive ad-fraud execution machine. Utilizing pre-installed applications linked to a mainland Chinese entity known as Zhejiang Fengwo IoT Technology Ltd. (operating under the banner of the Fengwo Group), the idle streaming sticks begin visiting synthetic, AI-generated news and blog websites.
Crucially, these devices engage in aggressive device spoofing. Despite operating on factory-installed Android TV hardware architectures, the streaming boxes transmit telemetry data falsely claiming to be high-end mobile phones manufactured by globally recognized brands, including Samsung, Huawei, Vivo, and Xiaomi. This elaborate masquerade ensures that the traffic triggers high-value mobile advertising payouts while bypassing basic fraud-detection filters designed to flag anomalous fixed-line devices.
Chronology: Unraveling the Fengwo Ad-Fraud Operation
The discovery of this vast digital fraud ring was not born of luck, but of careful investigative tracking and opportunistic data collection.
- 2019: Zhejiang Fengwo IoT Technology Ltd. is founded in mainland China, gradually building an extensive portfolio of ad-publishing networks and registering intellectual property patents that align directly with automated UI-interaction software frameworks.
- Early 2025 – January 2026: Security services and proxy tracking firms, including Synthient, note a dramatic surge in compromised IoT devices. Botnets like Kimwolf are documented enslaving millions of unauthenticated streaming boxes using systemic vulnerabilities in pre-installed residential proxy packages.
- Mid-2026: Pedro Falé of Bitsight registers an expired domain name previously utilized for telemetry collection by tens of thousands of H96 streaming sticks worldwide. By capturing this traffic, Falé gains unprecedented visibility into the command-and-control infrastructure of the device fleet.
- The Discovery: Upon inspecting the inbound data packets, Falé observes an impossible anomaly: thousands of fixed-location Android TV boxes are reporting hardware and application lists characteristic of mobile smartphones. Tracing the supporting software infrastructure leads researchers directly to the Fengwo Group, its network of shell companies in financial hubs across Asia, and its underlying automated development pipelines.
- July 2026: Bitsight publishes its definitive technical report, exposing the nexus between cheap streaming hardware, low-code generation platforms, and multi-million-dollar ad-fraud ecosystems.
Supporting Data: Scale, Scope, and Financial Mechanics
The sheer economic scale of the Fengwo operation underscores the viability of modern cybercrime-as-a-service models applied to consumer IoT hardware.
According to Bitsight’s telemetry data, the research team tracked approximately 38,000 distinct H96 TV boxes actively phoning home to a single expired telemetry domain. Based strictly on interaction metrics from this isolated sample, researchers conservatively estimate that the network generates roughly $50,000 per day in fraudulent ad revenue. This figure notably excludes additional revenue streams generated through the simultaneous operation of the residential proxy network.
The mechanics behind the ad-fraud engine are equally industrialized. The Fengwo Group utilized internal wiki platforms and proprietary implementations of Google’s Blockly—a visual programming language originally engineered to teach software development to children. By combining Blockly with modular S3 bucket repositories, the operation drastically reduced its overhead and technical requirements.
According to internal developer communications uncovered by Bitsight, this low-code infrastructure allowed a small core of elite engineers to build complex execution templates. Less skilled operators could then simply drag and drop visual code blocks to define automated tasks—such as launching hidden browsers, managing tabs, simulating scrolls, and executing ad clicks—without understanding the underlying source code.
Furthermore, to outsmart modern fraud mitigation tools, the network integrated advanced vision and reasoning systems. These systems allow automated bots to scan AI-generated web pages—spanning finance, health, gaming, food, and music blogs—and interact with advertisements in a manner indistinguishable from organic human navigation.
Intriguingly, the primary public face of the operation—a domain registered as fwgcloud.com—promotes the Fengwo Group as an artificial intelligence pioneer claiming to have created over 120,000 "AI digital humans" for customer service and emotional companionship. Security experts, however, view this grandiose storefront as an intentional camouflage tactic designed to mask the firm’s true botnet and ad-fraud infrastructure behind a respectable corporate facade.
Official Responses and Industry Reactions
As the scope of IoT-based criminal activity expands, international regulatory and law enforcement bodies have intensified their warnings to consumers and retail corporations alike.
The Federal Bureau of Investigation (FBI) has repeatedly issued public alerts warning that home internet-connected devices, particularly unbranded streaming media players and digital photo frames, are routinely exploited to facilitate cybercrime. These devices serve as convenient springboards for threat actors seeking residential IP addresses to obscure illicit digital footprints.
Despite these government warnings and mounting security research, major international e-commerce giants—including Amazon, Best Buy, and Newegg—continue to host hundreds of third-party vendors selling uncertified Android-based TV boxes. These devices are frequently promoted by social media influencers as cost-free alternatives to legitimate subscription-based streaming platforms, completely masking the profound cyber risks embedded within their firmware.
Industry responses have begun to harden elsewhere in the consumer electronics sector. For instance, major television manufacturers like LG have recently announced sweeping policy updates aimed at banning residential proxy software from smart TV application ecosystems.
When security researchers attempted to reach out to the Fengwo Group for comment through the corporate email address listed on fwgcloud.com, the inquiries were immediately rejected by mail delivery servers with automated bounce-back messages noting that the inbox was completely overwhelmed or full—a fitting metaphor for an infrastructure drowning in automated digital traffic.
Implications: The Consumer Dilemma and Moving Forward
The exposure of the H96 and Fengwo ad-fraud empire carries severe implications for the broader digital advertising ecosystem, corporate networks, and everyday consumers.
For digital merchants and advertising networks, botnets powered by residential IoT hardware represent a notoriously difficult challenge. Because the traffic originates from legitimate residential IP blocks and successfully spoofs mainstream mobile operating systems, traditional fraud detection engines frequently misclassify these automated interactions as genuine consumer interest, draining advertising budgets and distorting market analytics.
For the everyday consumer, the risks are more immediate and personal. Bringing an uncertified, generic streaming box into a home or office environment effectively introduces an unauthenticated, remotely managed computer onto a trusted local network. As demonstrated by security tracking firms like Synthient—which maintains a comprehensive public directory of compromised IoT hardware—these devices are frequently targeted by multiple competing botnets simultaneously, creating a cascading web of security vulnerabilities.
Security experts emphasize that safeguarding personal privacy and home network integrity requires a fundamental shift in purchasing habits. Consumers are strongly advised to:
- Stick to Reputable Brands: Purchase streaming devices exclusively from established, trusted manufacturers (such as Google, Roku, Apple, and Amazon Fire TV) that provide verifiable security updates and maintain official operating system certifications.
- Verify Play Protect Status: Consumers can easily check whether an Android-powered device runs the official, certified Android TV operating system by following verification guides provided directly through Google Play support pages.
- Audit Connected Peripherals: Periodically inspect local networks for unknown devices, maintain updated firmware across all routers, and remain deeply skeptical of hardware marketed around promises of bypassing standard subscription fees.
As cybercriminals increasingly pivot toward leveraging consumer IoT infrastructure for automated ad fraud and proxy leasing, vigilance, hardware accountability, and regulatory oversight will remain the frontline defense against the growing shadow economy operating within our living rooms.
Lina Irawan 
rifanmuazin 
Neng Nana 