The Hidden Cost of Cheap Streaming: How Generic TV Boxes Are Fueling a Global Ad Fraud Empire

The proliferation of inexpensive, generic Android-based TV streaming boxes has long been a subject of concern for cybersecurity professionals, who have frequently warned consumers that these "too good to be true" devices often act as backdoors into private home networks. However, a groundbreaking investigation by the security firm Bitsight has unveiled that the danger extends far beyond mere eavesdropping. These devices are being weaponized as part of a sophisticated, global ad fraud operation that spoofs mobile devices to generate millions of dollars in illicit revenue for a mainland Chinese entity known as the Fengwo Group.

The Anatomy of the Fraud

For years, security researchers have documented how off-brand TV boxes, often marketed as cost-effective alternatives to name-brand streaming hardware, come pre-loaded with residential proxy software. This software essentially turns a user’s home internet connection into a node for a commercial proxy network, renting out bandwidth to third parties—ranging from legitimate scrapers to cybercriminals—without the owner’s consent.

The recent analysis by Pedro Falé, a threat researcher at Bitsight, has uncovered a far more insidious layer to this ecosystem. By registering an expired domain previously used for device telemetry by the popular "H96" brand of streaming sticks, Falé was able to intercept data transmissions from tens of thousands of infected units worldwide. The discovery was startling: the devices were not just acting as proxies; they were actively masquerading as premium mobile smartphones, including models from Samsung, Huawei, and Xiaomi, to manipulate advertising metrics.

This spoofing mechanism allows the H96 devices to report false hardware profiles to advertising networks. By mimicking a mobile device, the boxes can interact with AI-generated websites—news portals, health blogs, and gaming sites—and execute automated ad clicks. Because the ad networks believe the traffic is originating from a legitimate mobile user rather than a stationary, hacked TV box, the clicks are validated, and the perpetrators reap the financial rewards.

A Chronology of Deception

The roots of this operation trace back to the founding of Zhejiang Fengwo IoT Technology Ltd in 2019. Over the past several years, the company has methodically built a portfolio of ad-publishing websites and software designed to capitalize on the ubiquity of insecure IoT devices.

• 2019: Zhejiang Fengwo IoT Technology Ltd is founded in mainland China, establishing the infrastructure for its ad-publishing business.
• 2021-2023: As demand for cheap streaming devices surges during and after the pandemic, the Fengwo Group integrates its proprietary apps into the firmware of H96 and other white-label TV boxes.
• 2024: The network reaches significant scale, with Bitsight tracking approximately 38,000 devices consistently communicating with the group’s telemetry servers.
• January 2026: Researchers at the proxy tracking service Synthient document the "Kimwolf" botnet, which leverages vulnerabilities in pre-installed proxy software to enslave millions of IoT devices globally.
• July 2026: Bitsight releases its comprehensive report detailing how these devices utilize AI-driven vision systems to navigate websites and click ads, confirming that the fraud is automated through Blockly-based code modules.

Sophisticated Automation: The Blockly Connection

One of the most alarming aspects of the Fengwo Group’s operation is its use of Google’s Blockly, a visual programming language designed to teach children how to code. By creating a custom interface using Blockly, the group has lowered the barrier to entry for its operators. These individuals, who may lack advanced technical skills, can simply drag and drop "code blocks" to define new fraud routines.

Once defined, these routines are exported as JavaScript and deployed via cloud-based S3 buckets to the captive army of TV boxes. The devices are programmed to be "smart" in their deceit: they switch between roles based on usage patterns. If the device detects an HDMI signal—indicating the user is watching television—it functions as a standard proxy to avoid performance degradation that might alert the user. However, when the TV is powered off, the device shifts into "ad fraud mode," aggressively launching browsers and navigating web pages to maximize ad revenue.

To bypass modern bot detection systems, the Fengwo Group has implemented a fusion of vision and reasoning systems. This allows the botnet to accurately identify ad placements on a page and interact with them in a way that mimics human behavior, effectively outmaneuvering traditional fraud detection algorithms that rely on simple "click-rate" analysis.

Financial Implications and Scale

The scale of this operation is staggering. Based on telemetry from just one of the Fengwo Group’s older domains, Bitsight estimates the network generates approximately $50,000 in daily revenue. This figure is likely a significant underestimation, as it does not account for revenue derived from their residential proxy services or other, more recently deployed domains.

The Fengwo Group’s website claims they manage over 120,000 "AI digital humans" available for hire. While this may be a marketing facade intended to project legitimacy or obscure the true nature of their botnet, it highlights the increasingly blurred line between legitimate AI-driven services and malicious automated infrastructure.

The Regulatory and Consumer Challenge

Despite repeated warnings from the FBI and international cybersecurity agencies, the supply chain for these devices remains largely unchecked. Major e-commerce platforms, including Amazon, Newegg, and Best Buy, continue to host third-party sellers offering these uncertified, insecure devices. These boxes are frequently promoted by social media influencers as "jailbroken" or "unlocked" solutions for free streaming, a marketing tactic that effectively masks the underlying malicious firmware.

The implications for consumers are severe. Beyond the violation of privacy and the illicit use of home bandwidth, these devices represent a massive, persistent security hole in the home network. Because they are often built with outdated, unpatched versions of the Android operating system, they serve as a beachhead for further network compromise. Once an attacker has control of the streaming device, they may be able to pivot to other devices on the same local area network, including computers, smart home appliances, and private storage servers.

Moving Toward a Secure Future

The cybersecurity community is increasingly calling for stricter certification requirements for IoT devices. Google has long maintained a certification process for "Android TV OS" devices, which ensures a baseline level of security and software integrity. Consumers are strongly advised to check whether their device is Play Protect certified.

Furthermore, the industry is seeing a push toward transparency. Services like Synthient are now maintaining public databases of known "tainted" IoT hardware. Experts suggest that the only effective way to mitigate this threat is for retailers to take greater responsibility for the supply chain, enforcing strict security audits for any smart device sold on their platforms.

Until such standards are universally adopted, the burden of security falls on the consumer. The advice from experts remains consistent: if a streaming device is priced significantly lower than name-brand alternatives like those from Google, Roku, or Apple, it is likely that the "cost" is being subsidized by the secret exploitation of the user’s network and personal data. In the world of digital hardware, the cheapest option often comes with a hidden price tag that no consumer should be willing to pay.