Generic Android TV boxes marketed as unlimited streaming devices arrive pre-installed with malware that simultaneously rents out the buyer’s internet connection and spoofs mobile phone identities to commit advertising fraud, according to research published July 30, 2026, by threat intelligence firm Bitsight.
The analysis, authored by Bitsight TRACE researcher Pedro Falé, focuses on a campaign the firm calls the “Fuyao Enterprise,” tied to Zhejiang Fengwo IoT Technology Ltd., a mainland China company founded in 2019. Bitsight identified approximately 38,000 devices still phoning home to an expired Fengwo command-and-control domain. The firm estimates the operation generates roughly $50,000 per day in fraudulent ad revenue from confirmed infections alone.
How the Devices Work Against Their Owners
The H96-brand Android TV box is the central device identified in the Bitsight report. Two apps arrive pre-installed at the ROM level, granting them system-level privileges that survive a factory reset. The apps communicate with Fengwo infrastructure at fwgcloud[.]com.
The malware operates in two distinct modes keyed to a hardware signal: whether an HDMI connection is active.
When the television is on, the box functions as a residential proxy. The owner’s IP address is leased to third parties, who route their own traffic through it. This is the same category of abuse the FBI warned about in 2025 advisories, in which home devices enrolled in proxy networks can make illicit traffic appear to originate from ordinary consumer ISP addresses.
When the television is off, the box pivots to ad fraud. The same apps modify Android system properties to impersonate consumer smartphones — Samsung, Vivo, Huawei, and Xiaomi models, among others. A command-and-control endpoint at /app/device/getBoxModel delivers spoofing configurations, including device profiles such as “Meizu M3 Note.” Chipset identifiers from the underlying hardware, which the report documents as Rockchip and MediaTek parts, are stripped from the spoofed profile to prevent detection by ad-verification systems that flag TV chipsets.
AI-Generated Sites as the Fraud Surface
The spoofed devices visit a network of AI-generated websites spanning finance, health, education, and gaming verticals. These sites serve ads only to requests carrying the spoofed H96 mobile device profiles, a targeting mechanism that filters out legitimate visitors and ad-fraud researchers while ensuring the fake impressions and clicks reach paying advertisers.
Bitsight captured approximately 166 unique fraud modules built on Google’s Blockly visual programming language, the same drag-and-drop coding environment used in children’s programming curricula. Falé’s report notes that operators “use Blockly, a visual programming language, usually reserved to teach kids learning to code, to construct on their side the logic behind the extremely modular fraud tasks.” The design choice lowers the technical barrier for operators, allowing new fraud routines to be assembled without writing native code.
The broader Fengwo Group has publicly claimed to operate 120,000 “AI digital humans,” a figure that suggests the confirmed 38,000 active beacons represent a fraction of total deployed devices.
Supply Chain and Retail Exposure
The infection is not acquired post-purchase. Bitsight’s analysis indicates the malicious apps are embedded during manufacturing or the ROM-building stage, before any device reaches a retailer. H96 and similar no-brand Android TV boxes remain listed on Amazon, Best Buy, and Newegg at the time the Krebs report was published.
The supply chain vector makes the threat difficult to address at the consumer level. There is no malicious download for an end user to avoid, no phishing link, no user action that enables infection. The compromise ships inside the box.
Fengwo’s corporate structure shows multiple shell entities across Hong Kong and Singapore, the same layered-ownership pattern that makes bulletproof hosting takedowns hard to make permanent. The Krebs reporting notes that proxy-tracking service Synthient documented in January how multiple botnets had rapidly enrolled millions of TV boxes into residential proxy services through a complex interplay of security vulnerabilities.
What Defenders and Procurement Teams Should Do
For security operations centers and IT procurement teams, this campaign illustrates why asset provenance matters for devices with persistent network presence.
Immediate steps:
- Block known Fengwo domains and IP ranges at the perimeter. The primary C2 domain
fwgcloud[.]comshould be added to DNS blocklists. Bitsight’s report includes indicators of compromise. - Audit any Android TV boxes already on the network. Devices from H96 and similar white-label Chinese manufacturers should be treated as untrusted until verified. Look for anomalous outbound connections, especially to cloud endpoints not associated with known streaming services.
- Review procurement policy for consumer-grade streaming hardware. Devices sold at sub-$50 price points with no named U.S. or EU entity behind the brand carry elevated supply-chain risk. Require known-brand hardware (Roku, Amazon Fire TV, Google TV) or enterprise-grade digital signage endpoints.
- Notify non-technical users. Home users with these devices on residential ISP connections are unknowing participants in proxy networks and ad fraud operations. The FBI has issued prior alerts on this category; link staff and contractors to those advisories.
- Monitor for residential proxy traffic signatures. SOC teams analyzing outbound flow data should flag long-lived connections from non-server endpoints to commercial proxy broker infrastructure, particularly from IoT or HDMI-attached devices.
Context: A Pattern, Not an Outlier
This campaign fits an established pattern. Security researchers have documented Android TV box malware for years, including operations variously linked to the BadBox malware family and earlier residential proxy schemes. What distinguishes the Fuyao Enterprise analysis is the granularity of the operational detail: the Blockly-based fraud automation, the AI-generated site network targeting device-profile filters, and a documented revenue estimate grounded in per-device click-rate assumptions rather than speculation.
Enforcement in this space has largely landed on the infrastructure layer rather than on the devices themselves. The Dutch seizure of more than 800 servers tied to a sanctioned hosting network is one recent example of that approach.
The retail availability of the affected devices underscores a recurring policy gap. Hardware with demonstrated malicious behavior at the firmware level continues to move through major U.S. retail channels without a clear removal mechanism. Until that changes, the practical defense is purchase avoidance and network segmentation.
→ This post is part of the AI Security Threat Intelligence Hub, the complete resource index for AI security coverage on Tech Sentinel.
