Executive Overview
For years, cybersecurity professionals and intelligence agencies have sounded the alarm over the hidden perils of cheap, generic TV streaming boxes. Marketed aggressively across major e-commerce platforms like Amazon, Best Buy, and Newegg, these low-cost devices promise a tantalizing reward: free access to unlimited live television, premium sports, and on-demand movies without the burden of a monthly subscription. However, security researchers have long warned that these boxes operate as covert tools, quietly transforming residential home networks into rental properties for strangers.
Now, a groundbreaking investigation by threat intelligence firm Bitsight reveals that the threat is far more sinister—and lucrative—than previously understood. Beyond turning unsuspecting users’ internet connections into commercial residential proxies, a wildly popular brand of streaming devices known as H96 has been caught running a sprawling, automated ad fraud empire.
According to Bitsight threat researcher Pedro Falé, tens of thousands of these devices are systematically spoofing mobile phones to simulate ad clicks on artificial intelligence-generated websites. Controlled by a mainland China-based entity known as Zhejiang Fengwo IoT Technology Ltd. (operating under the Fengwo Group), the operation generates an estimated $50,000 daily from ad fraud alone, entirely separate from its proxy monetization revenue.
This exposé examines the anatomy of this global cyber threat, detailing how cheap consumer hardware is weaponized using AI, low-code tools, and sophisticated evasion techniques, while major retailers continue to profit from their sale.
Detailed Chronology & Investigation: Unmasking the H96 Botnet
The discovery of this massive ad fraud operation was not the result of a lucky guess, but rather a methodical, forensic pivot by Bitsight security researchers. The breakthrough began when Pedro Falé registered an expired domain name that had previously been utilized for telemetry by H96 streaming sticks.
The Telemetry Trap
Telemetry data is designed to help manufacturers monitor device health by collecting hardware information and lists of installed applications. In the case of the H96 devices, this telemetry was being funneled to servers around the globe from tens of thousands of units plugged into living room televisions.
Upon analyzing the live traffic hitting the newly acquired domain, Falé immediately noticed an alarming discrepancy. The telemetry payloads reported that the connected devices possessed hardware and software configurations belonging to modern mobile phones from prominent manufacturers—including Samsung, Vivo, Huawei, and Xiaomi.
"We noticed something was wildly wrong," Falé remarked. "Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.’"`
Tracing the Culprit to Zhejiang Fengwo
Digging deeper into the device payloads, Falé discovered that nearly all of the compromised H96 units shared the exact same two pre-installed applications. Code analysis traced these applications back to Zhejiang Fengwo IoT Technology Ltd., a mainland China enterprise founded in 2019 that oversees a portfolio of ad-publishing operations known as the Fengwo Group.
Further corporate and technical mapping revealed that the Fengwo Group registered multiple patents directly matching the functional architecture of the malicious apps found on the streaming sticks. To obscure their financial tracks, the enterprise relied on a complex web of shell identities scattered across Hong Kong, Singapore, and single-person legal entities designed to collect monetization payouts.
Dual-State Operation: TV On vs. TV Off
Perhaps one of the most clever engineering choices discovered by Bitsight was how the malware preserved the illusion of normal device operation. The H96 streaming sticks never engaged in residential proxy traffic and ad fraud simultaneously.
Instead, Bitsight’s telemetry revealed a distinct behavioral threshold linked to the television’s power state:
- When the TV is ON: If the box detects an active HDMI signal—indicating the user is actively watching content—it shifts functions to operate purely as a residential proxy, selling the user’s bandwidth.
- When the TV is OFF: As soon as the television is powered down, the device drops its proxy duties and switches over to executing automated ad fraud routines.
Researchers concluded that this resource allocation was intentional. Ad fraud tasks are computationally heavy and resource-intensive; running them concurrently with video streaming would likely cause stuttering, buffering, or system crashes, instantly alerting the user that something was fundamentally wrong with their device.
Supporting Context & Metrics: The Mechanics of AI-Driven Ad Fraud
The Fengwo Group’s ad fraud apparatus is not merely a collection of simple scripts clicking aimlessly on static links. Instead, it is an industrialized, highly optimized machine leveraging artificial intelligence, visual programming languages, and multi-modal reasoning systems.
The AI-Generated Content Ecosystem
Bitsight discovered that the traffic generated by the spoofed H96 devices was directed toward a vast network of AI-generated websites operated by the Fengwo Group. These portals featured machine-generated news articles, graphics, and blogs spanning diverse categories, including finance, health, education, gaming, music, and food.
Crucially, these websites operated on a strict conditional logic: none of the sites displayed advertisements unless the visiting device successfully matched the spoofed mobile profile of an H96 streaming box. This ensured that the fraud detection filters employed by major ad networks were systematically bypassed, convincing algorithms that real mobile users were consuming and interacting with web content.
Democratizing Fraud via Blockly
One of the most striking revelations from the Bitsight report is how the Fengwo Group scales its development operations. The infrastructure is tied to a proprietary implementation of Blockly, a Google-built visual programming language originally designed to teach children how to code.
By utilizing a visual block-based editor, low-skilled operators within the Fengwo Group can drag and drop code blocks together to define specific ad fraud routines. They do not need to understand the underlying mechanics of JavaScript or network protocols.
- Once a fraud routine is constructed visually in the Blockly editor, it is exported as JavaScript and uploaded to Amazon Web Services S3 buckets.
- The system requires only a handful of master developers to build the core execution-unit templates, while low-skill operators can generate endless variations of fraud tasks.
- This division of labor drastically slashes operational overhead and payroll costs for the criminal enterprise.
Vision and Reasoning Systems
To ensure that the automated traffic looks authentic to advertising networks, the Fengwo Group integrated three distinct vision and reasoning systems into a unified interface. When an H96 device receives a specific fraud task module via an S3 bucket, it silently launches a web browser, navigates pages, manages multiple tabs, and simulates human-like mouse movements or finger taps. The vision systems allow the botnet to correctly identify advertisements on a webpage and click them with precision, mimicking human behavior so effectively that traditional bot-mitigation tools fail to flag the traffic.
Financial Scale and the "AI Digital Humans" Facade
Tracking approximately 38,000 active TV boxes globally phoning home to a single expired Fengwo Group domain, Bitsight calculated a conservative revenue estimate of nearly $50,000 per day generated exclusively from ad fraud. This figure completely excludes the substantial parallel revenue generated by renting out the devices as residential proxies.
Interestingly, the primary domain for the Fengwo Group (fwgcloud.com) boldly claims that the company is “redefining the boundaries of human-AI interaction,” boasting a catalog of over 120,000 rentable “AI digital humans” capable of handling everything from customer service to emotional companionship.
However, Bitsight concluded that this futuristic storefront is likely a clever operational facade. In the cybersecurity world, massive botnets and proxy networks frequently hide behind benign or high-tech corporate fronts to deflect regulatory scrutiny and avoid advertising the true scale of their malicious infrastructure. When KrebsOnSecurity attempted to verify these claims by emailing the contact address listed on the company’s homepage, the message bounced back immediately with an inbox-full error, suggesting the domain was little more than a dead-letter drop.
Official Statements & Industry Warnings
The findings from Bitsight underscore a systemic vulnerability within the global consumer Internet of Things (IoT) supply chain—one that law enforcement agencies and cybersecurity bodies have struggled to contain.
The FBI’s Ongoing IoT Campaign
In recent years, the Federal Bureau of Investigation (FBI) and international cybersecurity agencies have published multiple urgent alerts regarding home internet-connected devices facilitating criminal activity. Government warnings specifically highlight that off-brand streaming boxes, digital photo frames, and cheap smart-home accessories frequently ship from overseas factories pre-infected with malicious software.
Because these devices are manufactured with minimal regard for security, lack proper digital signatures, and are completely devoid of user authentication protocols, they serve as wide-open backdoors into private residential and corporate networks.
The Broad Threat of Residential Proxies
Beyond ad fraud, the pre-installation of residential proxy software on generic hardware creates severe legal and privacy liabilities for everyday consumers. When a device’s internet connection is rented out to anonymous third parties, the owner’s home IP address is used to mask malicious activities.
Past investigations by threat tracking firms like Synthient have documented how sophisticated botnets—such as the infamous Kimwolf botnet—have enslaved millions of generic TV boxes. These proxies have been exploited by aggressive web scrapers, credential-stuffing hackers, ticket-scalping bots, and state-sponsored cybercriminals, leaving innocent homeowners to deal with blacklisted IP addresses or visits from law enforcement.
+-----------------------------------------------------------------+
| THE H96 THREAT LIFECYCLE |
+-----------------------------------------------------------------+
| 1. Purchase: Consumer buys cheap, uncertified streaming box |
| from Amazon, Best Buy, or Newegg. |
+-----------------------------------------------------------------+
| 2. Infection: Device arrives pre-loaded with backdoors and |
| Fengwo Group ad-fraud / proxy applications. |
+-----------------------------------------------------------------+
| 3. Dual-State Execution: |
| - TV ON -> Acts as a residential proxy (renting bandwidth). |
| - TV OFF -> Executes AI-driven mobile phone ad fraud. |
+-----------------------------------------------------------------+
| 4. Monetization: Generates $50,000+ daily for threat actors |
| via automated clicks on AI-generated web content. |
+-----------------------------------------------------------------+Future Outlook & Consumer Defense Recommendations
As cybercriminals increasingly turn to artificial intelligence and low-code frameworks to automate illegal operations, the battleground for digital fraud has expanded far beyond traditional web browsers and corporate servers into the living rooms of everyday consumers. Despite mounting evidence and public safety warnings, major e-commerce marketplaces continue to list thousands of uncertified, white-label streaming devices that prioritize rock-bottom pricing over foundational cybersecurity.
Industry experts emphasize that systemic reform will require active intervention from major retailers, operating system developers, and international regulators. In the meantime, consumers must exercise extreme caution when purchasing smart home and entertainment hardware.
Actionable Guidance for Consumers
- Stick to Reputable Brands: Avoid purchasing ultra-cheap, unbranded streaming sticks from third-party marketplace sellers. Invest in well-known, name-brand hardware from reputable manufacturers (such as Google TV, Apple TV, Roku, or Amazon Fire TV).
- Verify OS Certification: Google provides official support guidelines allowing consumers to verify whether an Android TV device runs the official, secure Android TV OS with Google Play Protect certification. Unofficial "Android TV Boxes" running modified mobile versions of Android should be avoided entirely.
- Audit Your Network: Security researchers at Synthient maintain public open-source research repositories (such as product name registries on GitHub) documenting IoT devices known to ship with pre-installed residential proxy software and malware.
- Isolate IoT Hardware: If unverified smart devices must be kept on a home network, place them on an isolated Guest Network or Virtual Local Area Network (VLAN) to prevent compromised hardware from scanning, pivoting to, or infecting other sensitive computers and personal devices connected to your primary network.
