--- title: Read This Before You Buy That TV Streaming Stick – Krebs... description: Generic TV streaming sticks sold on Amazon and other major retailers are secretly enrolled in a sophisticated ad fraud operation run by a Chinese company... canonical: https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Read This Before You Buy That TV Streaming Stick – Krebs on Security | daily.dev og:description: Generic TV streaming sticks sold on Amazon and other major retailers are secretly enrolled in a sophisticated ad fraud operation run by a Chinese company... og:url: https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth og:image: https://api.daily.dev/og/posts/XSRnJpbTH.png og:image:alt: Read This Before You Buy That TV Streaming Stick – Krebs on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Read This Before You Buy That TV Streaming Stick – Krebs on Security **[Krebs on Security](https://daily.dev/sources/krebsonsecurity)** · 8 min read · 0 upvotes · 0 comments ## Summary Generic TV streaming sticks sold on Amazon and other major retailers are secretly enrolled in a sophisticated ad fraud operation run by a Chinese company called Zhejiang Fengwo IoT Technology (Fengwo Group). Researcher Pedro Falé of Bitsight TRACE discovered the scheme by registering an expired domain used to coordinate the botnet, finding that H96 streaming devices spoof themselves as Samsung, Huawei, Vivo, and Xiaomi phones to click ads on AI-generated websites. The devices switch between acting as residential proxies (when the TV is on) and performing ad fraud (when the TV is off). Fengwo Group uses a modified version of Google's Blockly visual programming language to let low-skilled operators build fraudulent ad-clicking routines. Bitsight tracked ~38,000 devices phoning home to one domain alone, estimating revenues near $50,000/day from ad fraud. Consumers are advised to buy only certified Android TV devices from reputable brands and avoid sideloaded apps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 122 comments across hackernews (as of 2026-08-03). **TL;DR:** Commenters are largely unsurprised that cheap Chinese streaming boxes are malware-laden residential proxies and ad-fraud bots, and debate whether buyers are naive victims or willful participants; the thread also branches into what privacy-respecting streaming alternatives exist and broader concerns about IoT device security. **Sentiment:** 5% positive · 30% mixed · 65% skeptical **The case for** - Fake ad clicks harm advertisers and ad networks, which some commenters see as a minor silver lining. - Legitimate free IPTV streams exist as a legal alternative for cord-cutters. - Apple TV is widely cited as the best balance of privacy and convenience among mainstream streaming devices. **The pushback** - These devices come factory-loaded with residential proxy software and ad-fraud malware, exposing buyers' IP addresses to criminal activity without their knowledge. - The problem is far broader than one device line — a tracking list covers nearly 1,000 makes and models. - Major retailers like Amazon, Best Buy, and Newegg continue selling these devices despite their known malicious behavior. - Buyers who knowingly use piracy boxes are complicit in the broader ecosystem even if they don't understand the malware angle. - Even 'legitimate' smart TVs (e.g., LG in Brazil) may behave similarly, suggesting the issue extends well beyond obvious piracy sticks. **By community** - hackernews (skeptical): Commenters are largely unsurprised and critical, debating buyer culpability, recommending Apple TV as the least-bad alternative, and flagging that major retailers enabling the sale makes legal remedies toothless. **Hottest debate:** Whether buyers of these piracy boxes are innocent victims who don't understand the risks or knowing participants who choose not to think too hard about what they're enabling. **Open questions** - Is there any practical way for home users to detect or block residential proxy and ad-fraud traffic at the router level? - Will Apple TV eventually follow other platforms into aggressive advertising, eliminating the last 'clean' mainstream option? - How broadly are nominally legitimate smart-TV brands (LG, etc.) also shipping with proxy or spyware functionality? **Highlights** > It's not just one device line; Have a look at the list maintained by the proxy tracking service Synthient, which tracks streaming boxes, digital picture frames and other IoT devices that have been known to bundle residential proxy software, among other malicious apps. They currently track almost 1,000 different makes and model numbers. https://github.com/synthient/public-research/blob/main/2026/... > — [krebsonsecurity on hackernews](https://news.ycombinator.com/item?id=49113084) > Of course, what they're missing is that laws are for poor people. Amazon will be notified they sold something illegal and will take it down and ban the seller who will immediately launch a new store under a new name. The purchaser, on the other hand, will be fully liable for whatever horrible thing they bought. > — [Pxtl on hackernews](https://news.ycombinator.com/item?id=49114636) > I know a few people who buy these, and they kind of know what they're doing. They just try and not think about it too hard. It reminds me of the saying: "It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It". If these people thought about it for a few minutes, they would understand, but they choose not to, as ignoring it is too advantageous. I admit I was tempted, as the price of all streaming services goes up, and services become more and more fragmented. During the same period where I have not had a raise. > — [rng-concern on hackernews](https://news.ycombinator.com/item?id=49114764) > > major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands that bundle unofficial versions of Google’s Android operating system and are frequently marketed (via online influencers) as a way to access a broad array of streaming services and live broadcasts without a subscription. This is why I giggle when people talk about ending Section 230 in the USA (or various international counterparts thereof). The largest companies on Earth are happily selling hacked piracy spyware botnet garbage. Not just hosting malicious posts for free like Section 230 protects, but selling illegal physical devices and taking a cut of the profit and excusing it with a pathetic whack-a-mole moderation system. It's already illegal and the law has already failed. Sean Parker's mistake was that he wasn't rich enough. Laws are for poor people. > — [Pxtl on hackernews](https://news.ycombinator.com/item?id=49114606) > I can’t prove it, but I live in Brazil and after getting a smart TV from LG, I started receiving challenges across all Google services, indicating they received bot traffic from my network. I only used apps from streaming services I actually paid for. I suspect these TVs either come with residential proxies set up from the factory, or they have such poor security that they’re instantly hacked. Either way, TV manufacturers (including reputable ones like LG) are to blame. > — [drdexebtjl on hackernews](https://news.ycombinator.com/item?id=49113373) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49112744) · 81 points · 122 comments ## Similar posts on daily.dev - [Is Your Android TV Streaming Box Part of a Botnet? – Krebs on Security](https://daily.dev/posts/is-your-android-tv-streaming-box-part-of-a-botnet-krebs-on-security-kajzwi9lv) · Krebs on Security · 0 upvotes · 0 comments - [Amazon is cracking down on illegal streaming on its Fire TV Stick](https://daily.dev/posts/amazon-is-cracking-down-on-illegal-streaming-on-its-fire-tv-stick-g8t6b6ckt) · The Verge · 0 upvotes · 0 comments - [Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks](https://daily.dev/posts/kimwolf-botnet-hijacks-1-8-million-android-tvs-launches-large-scale-ddos-attacks-eacmovs1r) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Read This Before You Buy That TV Streaming Stick – Krebs on Security","url":"https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth"},"datePublished":"2026-07-30T16:54:03.150Z","dateModified":"2026-08-03T12:23:46.988Z","description":"Generic TV streaming sticks sold on Amazon and other major retailers are secretly enrolled in a sophisticated ad fraud operation run by a Chinese company...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9fd67505147d0d387145205c8f329c3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9fd67505147d0d387145205c8f329c3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Krebs on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Krebs on Security","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/deb3e417ddef4d0e8cc4d704becf6004","url":"https://daily.dev/sources/krebsonsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/read-this-before-you-buy-that-tv-streaming-stick-krebs-on-security-xsrnjpbth","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Krebs on Security","item":"https://daily.dev/sources/krebsonsecurity"},{"@type":"ListItem","position":3,"name":"Read This Before You Buy That TV Streaming Stick – Krebs on Security"}]} ```