GeekNews is posting this article to inform you about things to be careful of when purchasing a TV streaming stick.
Tens of thousands of H96 streaming devices have been found disguised as mobile phones, clicking ads on AI-generated websites and lending users' internet connections to an external network.
The Zhejiang Fengwo IoT Technology app installed on the devices automates tasks such as browser execution, page navigation, tab management, and ad clicks using Blockly modules.
When an H96 detects an HDMI signal from a TV, it functions as a residential proxy. When the TV is turned off, it switches roles to perform resource-intensive ad fraud tasks.
Bitsight tracked approximately 38,000 devices globally from a single expired domain, estimating daily ad fraud revenue of around $50,000. This is considered a conservative figure as it only reflects one outdated core domain.
Choose devices from reputable manufacturers with official Android TV and Play Protect certifications and limit app installations. Unknown IoT products may have residential proxies or malicious apps pre-installed.
The Ad Fraud Network Exposed by H96
Bitsight threat researcher Pedro Falé registered an expired domain that controlled the fake ad clicks of H96 devices to observe internal traffic.
This domain collected full hardware information and installed app lists from tens of thousands of H96 devices worldwide for telemetry purposes.
Most TV boxes sending data identified themselves as mobile phone models from brands like Samsung, Vivo, Huawei, and Xiaomi.
Two apps commonly found on all devices were developed by Zhejiang Fengwo IoT Technology Ltd., established in mainland China in 2019.
The company operates an ad publishing business under the name Fengwo Group.
Several registered patents match the internal workings of these apps.
Bitsight TRACE traced payments received to Hong Kong and Singapore entities, linking them to Fengwo Group.
AI-Generated Websites and Selective Ad Exposure
The device's apps utilize the H96 as a controlled traffic source, connecting to Fengwo Group's AI-generated websites and clicking ads.
These sites feature machine-generated news and graphics on various topics like finance, health, education, gaming, music, and food.
Ads are not visible to regular visitors but are only exposed to visitors matching the H96's fabricated mobile profiles.
Blockly Simplifies Operations
Fengwo Group's fwgcloud[.]com claims to have created over 120,000 ‘AI digital humans’ for rent, including companions, 24/7 customer service agents, and creative designers.
SSL certificate data from this domain leads to other domains related to the H96 app and mobile phone impersonation functionality.
Their internal wiki reveals Fengwo Group uses a visual programming language called Blockly, originally designed for children's coding education by Google.
Operators can construct fraud operation routines by dragging and dropping blocks without needing to understand the underlying code.
The saved routines are exported as JavaScript and uploaded to an S3 bucket.
A small number of skilled developers create template execution units, while less experienced developers can build upon these templates, reducing operational costs.
Selected H96 devices receive Blockly modules tailored to specific tasks.
They secretly launch browsers and visit websites.
They navigate pages and manage tabs.
They locate and click ads.
Fengwo Group combines three visual and reasoning systems into a single interface, enabling bots to identify ads and navigate websites like humans.
Role Switching Based on TV Usage
An H96 performs only one task at a time: either acting as a residential proxy relay or engaging in ad fraud.
When an HDMI signal is detected from a connected TV, it assumes the user intends to watch content and typically functions as a residential proxy.
When the TV is turned off, it reverts to a state ready for ad fraud tasks.
Falé believes this switching structure is used because ad fraud is resource-intensive and could interfere with the device's primary streaming function.
Security Risks Posed by Anonymous Streaming Devices
Although the FBI and security industry have repeatedly warned, retailers such as Amazon, Best Buy, and Newegg continue to sell hundreds of devices and brands that are not officially Google Android.
Almost all unknown streaming devices come pre-installed with residential proxy software that rents the user's IP address to anonymous paying customers.
Low-cost TV boxes have weak basic security and authentication features, bringing additional risks to home or office networks.
In January 2026, Synthient recorded a case where multiple botnets quickly took over millions of TV boxes by combining vulnerabilities in residential proxy software and streaming devices.
Tracking Scale and Revenue Estimates
Bitsight tracked approximately 38,000 TV boxes globally that connected to an expired Fengwo Group domain.
Based on this scale, the revenue of the ad fraud network is estimated at around $50,000 per day.
Significant revenue generated from the residential proxy business is not included in the calculation.
Falé considers this a very conservative estimate because it only used telemetry from one old core domain.
The promotion of '120,000 AI digital humans' could be marketing or a facade to hide the actual botnet size and operation.
Inquiries sent to the contact address on the Fengwo Group website were returned with an error message indicating a full inbox or too many emails.
Things to Check Before Purchasing and Using
Choose brand products from trusted manufacturers for TV boxes and streaming sticks, and review the apps you will install selectively.
Selecting only official devices does not completely eliminate the risk, as apps themselves may include residential proxy software.
You can check for official Android TV OS and Play Protect certification according to Google's guidelines.
Synthient maintains a list of IoT devices known to have residential proxies and malicious apps pre-installed.
The risks extend beyond streaming sticks and TV boxes. The FBI has warned that residential proxy software has also been found in other consumer IoT devices, such as digital photo frames from random brands.
▶ Original source: https://news.hada.io/topic?id=32000
