Executive Overview
For years, cybersecurity researchers and federal law enforcement agencies have warned consumers about the hidden dangers lurking inside unbranded, off-brand streaming television boxes. Promoted across major online marketplaces and by social media influencers as "all-in-one" entertainment solutions that promise access to premium channels and subscription streaming services for a modest one-time fee, these devices frequently mask a sinister secondary function: secretly hijacking the buyer’s home internet connection to serve as a node in commercial residential proxy networks.
However, a groundbreaking investigation by threat intelligence firm Bitsight reveals that the malicious ecosystem embedded within these cheap streaming sticks is far more complex, multi-layered, and lucrative than previously understood.
According to research led by Bitsight threat analyst Pedro Falé, popular budget streaming devices—most notably those operating under the H96 brand—are equipped with pre-installed backdoor software that actively participates in a massive, multi-million-dollar online ad fraud operation. The infected hardware routinely falsifies its digital identity, spoofing itself as premium mobile smartphones from manufacturers like Samsung, Huawei, Xiaomi, and Vivo.
Once disguised as mobile devices, these streaming boxes silently navigate to artificial-intelligence-generated web properties operated by a mainland Chinese technology entity known as Zhejiang Fengwo IoT Technology Co., Ltd. (operating commercially as the Fengwo Group). Utilizing visual programming tools originally developed to teach children how to code alongside multi-modal AI vision systems, the operators instruct these enslaved streaming sticks to load web pages, scroll through machine-generated articles, and click on advertisements—draining advertising budgets from online merchants and ad networks around the globe.
Detailed Chronology of the Discovery
Phase 1: The Domain Acquisition
The investigation began when Pedro Falé registered an expired domain name that had previously been hardcoded into the firmware of generic H96 Android TV boxes. In the realm of threat intelligence, sinkholing an expired domain previously used for Command-and-Control (C2) or telemetry collection allows researchers to observe incoming traffic from infected or managed endpoints worldwide.
Falé anticipated seeing routine ping requests from generic Android-based streaming media players. The primary telemetry endpoints were meant to gather basic system health metrics, hardware configurations, and lists of installed applications from tens of thousands of consumer TV sticks plugged into living room televisions globally.
[ Inactive H96 Device ] ---> (Expired C2 Telemetry Domain) ---> [ Bitsight Research Sinkhole ]
│
▼
[ Identity Anomaly Discovered: ]
"Android TV Box" identifying as
Samsung, Xiaomi, Vivo, Huawei PhonesPhase 2: The Anomaly in the Telemetry
As the sinkhole began capturing live inbound connections, Falé identified a glaring technical discrepancy. While the hardware fingerprints, chipsets, and network behaviors clearly corresponded to set-top TV boxes, the HTTP headers, User-Agent strings, and system registration profiles transmitted by the devices claimed that the endpoints were high-end mobile smartphones.
"We noticed something was wildly wrong," Falé reported. "Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.’"
Device identities were being artificially manipulated at the system level. By presenting streaming sticks as mobile handsets, the controllers could bypass fraud detection mechanisms used by digital advertising networks, which routinely pay higher cost-per-click (CPC) rates for impressions and interactions originating from real mobile devices compared to stationary smart TVs or desktop platforms.
Phase 3: Unmasking Zhejiang Fengwo IoT Technology
Further examination of the telemetry payload revealed that every connected H96 device had two specific system applications pre-installed at the factory level. Deep-code inspection traced the creation and control of these applications to Zhejiang Fengwo IoT Technology Ltd., a company established in 2019 in mainland China that manages an extensive digital ad-publishing network under the corporate umbrella of the Fengwo Group.
Bitsight’s TRACE team conducted a corporate infrastructure mapping effort, uncovering a tangled network of legal shell entities, single-person holding companies, and monetization handles registered across Hong Kong and Singapore. These intermediary entities were structured to collect payout disbursements from global ad networks before routing the funds back to the parent firm in mainland China. Furthermore, public patent registries revealed that Zhejiang Fengwo IoT Technology had formally filed patents describing the precise device-spoofing and traffic-orchestration mechanics embedded inside the H96 firmware.
Technical Mechanics: AI, Low-Code Automation, and Multi-Modal Vision
The infrastructure constructed by the Fengwo Group highlights a sophisticated convergence of artificial intelligence, low-code operational frameworks, and computer vision designed to maximize profit while minimizing engineering overhead.
Low-Code Fraud Workflows via Modified Blockly
To scale their ad fraud operations without needing an army of senior software engineers, the Fengwo Group integrated an internal customized deployment of Blockly—an open-source visual programming framework developed by Google to teach children software development principles through drag-and-drop code blocks.
+-----------------------------------------------------------------------+
| FENGWO GROUP OPERATOR |
| [ Drag-and-Drop Blockly UI: "Open Browser" -> "Scroll Page" -> "Click Ad" ] |
+-----------------------------------------------------------------------+
│
▼ (Auto-compiled)
+-----------------------------------------------------------------------+
| JAVASCRIPT EXECUTABLE SCRIPT |
+-----------------------------------------------------------------------+
│
▼ (Pushed via AWS S3)
+-----------------------------------------------------------------------+
| CAPTIVE H96 STREAMING DEVICE (Headless Browser) |
+-----------------------------------------------------------------------+Inside Fengwo’s private development portals, non-technical operational personnel can drag visual logic blocks together to build complete, automated ad-fraud execution routines. Once an operator configures a task (e.g., launching a headless web browser, loading a specific URL, simulating mouse movement, managing active browser tabs, and clicking on target ad banners), the Blockly interface automatically compiles the visual blocks into executable JavaScript files. These scripts are then uploaded directly to Amazon Web Services (AWS) S3 buckets and pushed down to the captive H96 streaming devices.
Internal developer documentation recovered during Bitsight’s investigation revealed that this low-code modular design was an explicit business strategy. One Fengwo developer noted in internal logs that "only a small number of highly-skilled developers are needed to build the template execution-unit images," allowing operational employees with minimal technical training to create thousands of unique fraud tasks, dramatically slashing operating overhead.
AI Content Generation and Tri-Vision Mouse Automation
The receiving end of this fake traffic consists of thousands of artificial websites built and maintained by the Fengwo Group. These websites are populated with AI-generated text articles, synthetic stock imagery, and automated blogs covering diverse topics, including personal finance, healthcare, lifestyle, video games, culinary arts, and educational coding.
To make the interaction appear genuine to ad verification companies, these websites implement a conditional rendering gate: the ad units are completely suppressed unless the inbound visitor’s device profile matches the precise, spoofed mobile profiles generated by the pre-infected H96 streaming devices.
When an infected device visits one of these AI-generated publisher sites, simple automated clicking is insufficient to evade modern fraud detection algorithms. To overcome this, the Fengwo Group built a multi-modal computer vision and reasoning engine into their orchestration software:
- Visual Recognition: The software fuses three separate vision and reasoning systems to dynamically inspect the rendered web page structure in real time.
- Ad Identification: The AI identifies bounding boxes, native ad banners, and iframe placements on the screen.
- Human Simulation: The software generates non-linear cursor movements, introduces natural variable delays, scrolls down pages to simulate reader engagement, and registers clicks on ad units in a manner designed to mirror genuine human interaction.
Supporting Context & Metrics
Dual-Operational Modes: Proxy vs. Ad Fraud
One of the most remarkable operational discoveries made by Bitsight is the dynamic resource management employed by the H96 firmware. Threat analysts noted that the infected streaming devices actively alternate between acting as a residential bandwidth relay and performing CPU-intensive ad fraud.
+---------------------------+
| H96 STREAMING DEVICE |
+---------------------------+
│
[ Checks HDMI Output Signal ]
│
+-------------------------+-------------------------+
│ │
[ HDMI Active ] [ HDMI Inactive ]
(User is watching TV) (TV is powered off)
│ │
▼ ▼
+-------------------------+ +-------------------------+
| Residential Proxy Mode | | Ad Fraud Execution Mode |
| Relays third-party web | | Renders AI websites, |
| traffic quietly in | | runs computer vision, |
| background. | | clicks ads via Blockly. |
+-------------------------+ +-------------------------+- TV Powered On (HDMI Active): When the streaming box detects an active HDMI signal—indicating that the end consumer is actively watching video content—the device restricts its malicious activity to Residential Proxy Mode. In this state, it routes third-party web traffic (purchased by commercial subscribers, web scrapers, or cybercriminals) through the home network, using minimal system memory and CPU power so as not to interrupt the user’s video playback or cause buffering.
- TV Powered Off (HDMI Inactive): When the user turns off their television set, leaving the streaming box plugged in and idle on standby, the device triggers its Ad Fraud Execution Mode. Because headless browser automation, real-time image rendering, and AI computer vision require significant processing power, the device reserves these tasks for times when the user is unlikely to notice a drop in device performance or sudden network spikes.
Economic Impact and Botnet Revenue
Based solely on telemetry captured from a single expired legacy server domain, Bitsight monitored approximately 38,000 distinct H96 devices checking in daily across global consumer IP ranges.
Using conservative modeling metrics for digital advertising payouts (cost-per-thousand impressions [CPM] and cost-per-click [CPC] averages across mobile platforms), Bitsight estimates that this single subset of devices generates approximately $50,000 per day in fraudulent ad revenue for the Fengwo Group—equivalent to $18.25 million annually.
| Metric / Dimension | Observation / Estimate |
|---|---|
| Observed Active Endpoints | ~38,000 active H96 devices (on one sinkholed C2 domain) |
| Daily Estimated Ad Fraud Revenue | ~$50,000 USD (conservative baseline) |
| Annualized Fraud Revenue | ~$18.25 Million USD |
| Spoofed Identity Profiles | Samsung, Vivo, Huawei, Xiaomi mobile devices |
| Primary Monetization Entities | Shell identities in Hong Kong, Singapore, and Mainland China |
| Secondary Revenue Engine | Unmetered residential bandwidth proxy rentals |
Crucially, this estimate does not include the additional revenue stream generated by selling access to the devices’ underlying residential proxy networks, nor does it account for traffic routed through other active command-and-control domains operated by the enterprise.
The "AI Digital Human" Facade
The primary public-facing corporate website for the Fengwo Group (fwgcloud[.]com) presents the company as an innovative leader in artificial intelligence, claiming to be "redefining the boundaries of human-AI interaction." The site boasts a library of over 120,000 "AI digital humans" available for commercial license, targeting use cases such as 24/7 automated customer service, emotional companionship, and remote design work.
However, security researchers believe this front is a cover story designed to obfuscate their massive botnet infrastructure.
"Historically, when dealing with proxy services or DDoS operations, we sometimes see these websites undertake inconspicuous facades so as not to advertise their DDoS capability or botnet size," Falé observed. The 120,000 claimed "digital humans" may simply be a sanitized public metric reflecting the size of their underlying array of hijacked physical streaming endpoints.
Official Statements and Industry Responses
Efforts to contact the leadership of Zhejiang Fengwo IoT Technology Co., Ltd. yielded further evidence of an evasive infrastructure. Inquiries sent to the corporate administrative contacts published on fwgcloud[.]com returned hard delivery bounces:
"Your message couldn’t be delivered to postmaster@fwgcloud[.]com. Their inbox is full, or it’s getting too much mail right now."
Federal Law Enforcement and Industry Warnings
The findings arrive amid heightened scrutiny from federal authorities regarding connected consumer electronics sourced from unverified supply chains. The Federal Bureau of Investigation (FBI) has issued explicit warnings to consumers concerning the risks associated with off-brand Internet of Things (IoT) hardware and cheap streaming media players.
+-----------------------------------+
| MAJOR E-COMMERCE STORES |
| (Amazon, Newegg, Best Buy Market) |
+-----------------------------------+
│
▼
[ Uncertified Android TV Boxes ]
(Pre-installed with Firmware Malware)
│
+-----------------+-----------------+
│ │
▼ ▼
[ RESIDENTIAL PROXY NODE ] [ AD FRAUD BOTNET ]
(Sold to Cybercriminals / (Generates Fake Clicks
Traffic Scrapers) on AI Web Properties)Despite formal alerts, major e-commerce platforms—including Amazon, Newegg, and third-party merchant networks on Best Buy—continue to host listings for hundreds of variations of generic Android set-top boxes. Frequently promoted by affiliate marketing channels and social media influencers as budget-friendly alternatives to official media platforms, these devices rely on stripped-down, uncertified variations of the open-source Android operating system (AOSP) that lack official security hardening.
The Broader IoT Threat Landscape
The vulnerability of the IoT ecosystem extends well beyond the H96 brand:
- Kimwolf Botnet Operations: In early 2026, proxy monitoring firm Synthient published findings detailing how the "Kimwolf" botnet compromised millions of generic Android streaming sticks. The malware exploited security flaws in pre-installed residential proxy services to gain full local-network access, spreading laterally to other connected appliances.
- Smart TV Platform Policy Revisions: Recognizing the reputational risks associated with unauthorized network relays, major television manufacturers are taking countermeasures. Electronics giant LG recently announced platform-wide policy updates designed to block residential proxy software and unverified background services from running within its smart TV operating systems.
- Supply-Chain Contamination: Malicious firmware is not limited to set-top streaming boxes. Intelligence reports from Synthient and law enforcement agencies indicate that cheap digital photo frames, smart projectors, and off-brand Wi-Fi routers frequently ship from factories pre-loaded with proxy malware and persistent backdoors.
Future Outlook & Consumer Advisory
The discovery of the Fengwo Group’s ad-fraud network marks a significant evolution in consumer IoT exploitation. Cybercriminal enterprises are no longer content with merely stealing bandwidth or launching distributed denial-of-service (DDoS) attacks; they are now building fully integrated ad-fraud ecosystems that combine low-code workflows, computer vision, and dynamic device hardware spoofing directly within off-the-shelf consumer devices.
As long as marketplace platforms permit the sale of uncertified, grey-market Android devices, consumers must take proactive measures to protect their personal networks and privacy.
CONSUMER HARDENING CHECKLIST FOR STREAMING HARDWARE
┌───────────────────────────────────────────────────────────┐
│ [1] INSIST ON OFFICIAL PLATFORM CERTIFICATION │
│ Confirm Google Play Protect / Official OS status. │
├───────────────────────────────────────────────────────────┤
│ [2] AVOID GREY-MARKET "UNLOCKED" TV BOXES │
│ Refuse off-brand devices promising free services. │
├───────────────────────────────────────────────────────────┤
│ [3] ISOLATE IoT DEVICES ON GUEST NETWORKS │
│ Segment smart devices away from sensitive systems. │
├───────────────────────────────────────────────────────────┤
│ [4] AUDIT CONNECTED DEVICE LISTS REGULARLY │
│ Monitor router traffic logs for unusual outbound C2. │
└───────────────────────────────────────────────────────────┘Key Consumer Safety Recommendations
- Verify Official Certification: Google advises consumers to ensure that any Android-based media player is built with official Android TV OS and carries explicit Google Play Protect certification. Users can verify their device’s security status directly within the Google Play Store settings menu under the "About -> Play Protect certification" tab.
- Avoid "Free Content" Hardware Claims: Devices marketed with promises of "free unlimited streaming," "pre-unlocked channels," or permanent subscription bypasses almost universally fund their business model by monetizing the buyer’s home internet connection and processing hardware.
- Network Isolation (VLAN Segmentation): If non-certified IoT devices or generic smart appliances must be used, network administrators and consumers should isolate them on a dedicated Guest Wi-Fi network or Virtual LAN (VLAN). This prevents malicious firmware from scanning local subnet ranges or targeting primary laptops, smartphones, and storage drives.
- Consult Public Malicious IoT Repositories: Security research groups maintain public databases cataloging hardware products confirmed to ship with pre-installed proxy payloads. Users are encouraged to cross-reference potential hardware purchases against public tracking databases maintained by threat intelligence organizations like Synthient.
The interplay between low-code tools, computer vision, and hijacked consumer electronics ensures that ad fraud will remain a lucrative frontier for organized threat groups. Until supply-chain auditing and retail marketplace regulations adapt to these tactics, the burden of defense falls on consumers to carefully vet the connected hardware brought into their homes.
