Generic TV streaming sticks sold on Amazon and other major retailers are secretly enrolled in a sophisticated ad fraud operation run by a Chinese company called Zhejiang Fengwo IoT Technology (Fengwo Group). Researcher Pedro Falé of Bitsight TRACE discovered the scheme by registering an expired domain used to coordinate the botnet, finding that H96 streaming devices spoof themselves as Samsung, Huawei, Vivo, and Xiaomi phones to click ads on AI-generated websites. The devices switch between acting as residential proxies (when the TV is on) and performing ad fraud (when the TV is off). Fengwo Group uses a modified version of Google's Blockly visual programming language to let low-skilled operators build fraudulent ad-clicking routines. Bitsight tracked ~38,000 devices phoning home to one domain alone, estimating revenues near $50,000/day from ad fraud. Consumers are advised to buy only certified Android TV devices from reputable brands and avoid sideloaded apps.
