Hidden Botnets and Mobile Phone Spoofing: Unmasking the Global Ad Fraud Empire Operating Inside Cheap Android TV Boxes

For years, cybersecurity professionals and federal law enforcement agencies have issued urgent warnings regarding the hidden dangers of generic, unverified TV streaming boxes sold online. These inexpensive devices, which promise consumers unlimited access to premium content, live television, and pay-per-view broadcasts for a single, low, one-time fee, have long been suspected of harboring malicious software. Specifically, security researchers have repeatedly exposed how these streaming sticks secretly monetize their unsuspecting owners by turning home internet routers into commercial residential proxies, renting out user bandwidth to unknown third parties.

However, a groundbreaking and exhaustive analysis by threat intelligence firm Bitsight reveals that the malicious ecosystem surrounding these devices is far more vast, sophisticated, and economically damaging than previously understood. According to recent findings published by Bitsight threat researcher Pedro Falé, popular generic streaming devices—most notably a widely distributed brand known as H96—are not merely acting as passive proxies. Instead, they are actively orchestrating a complex, automated ad fraud operation. By spoofing their device telemetry to masquerade as mobile phones, these TV boxes systematically target AI-generated websites, clicking on digital advertisements to drain online marketing networks and defraud e-commerce merchants on a global scale.

The Anatomy of a Global Deception: How the Scheme Works

The scope of this multi-layered operation came to light when Bitsight researcher Pedro Falé secured an expired domain name that had historically served as a telemetry collection point for tens of thousands of H96 streaming devices plugged into television sets around the world. In its legitimate or operational function, this domain periodically gathered hardware diagnostics and comprehensive lists of installed applications from the connected hardware.

Upon analyzing the incoming data packets directed toward the recovered domain, Falé uncovered a glaring anomaly. The vast majority of the television streaming boxes—hardware explicitly designed to remain stationary in living rooms and connect to large displays via HDMI cables—were transmitting user-agent strings identifying them as popular mobile phone models manufactured by prominent global brands, including Samsung, Huawei, Xiaomi, and Vivo.

Further inspection of the telemetry revealed that every single one of these spoofed devices shared a common software footprint, specifically housing two identical pre-installed background applications. Digital forensics traced the origin of these applications to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland Chinese entity founded in 2019 that oversees a sprawling portfolio of ad-publishing operations collectively known as the Fengwo Group. Through public registries and corporate filings, Bitsight’s TRACE team linked the Fengwo Group to a web of single-person legal shell entities and financial collection accounts spanning Hong Kong and Singapore, all designed to funnel illicit monetization back to the parent organization in mainland China.

A Chronology of Rising IoT Threats and Regulatory Scrutiny

The discovery of the Fengwo Group’s ad fraud empire represents the latest escalation in a multi-year battle between cybersecurity defenders and malicious IoT operators. The timeline of vulnerabilities embedded within cheap consumer hardware highlights a persistent regulatory and marketplace failure:

• 2019: Zhejiang Fengwo IoT Technology Co., Ltd. is established in mainland China, subsequently developing proprietary ad-publishing frameworks and automation tools.
• 2021–2023: Security vendors begin noticing a surge in generic Android TV boxes utilizing pre-installed proxy software, prompting early warnings from researchers regarding bandwidth theft.
• January 2025: The Federal Bureau of Investigation (FBI) issues a formal cybersecurity alert warning consumers that unverified, internet-connected home devices—particularly streaming boxes and digital photo frames—are actively being weaponized to facilitate international cybercrime.
• November 2025: Cybersecurity investigations reveal that online influencers frequently market these unsecured devices across social media platforms, driving massive consumer adoption without disclosing the embedded security risks.
• January 2026: Proxy tracking service Synthient exposes the massive "Kimwolf" botnet, which successfully enslaved millions of generic TV boxes by exploiting vulnerabilities in both underlying streaming firmware and pre-loaded proxy applications.
• July 2026: Bitsight publishes its comprehensive investigation into the Fengwo Group, detailing how H96 devices utilize mobile spoofing, AI-driven web browsing, and automated visual scripting to execute large-scale ad fraud.

Engineering Efficiency: Low-Skill Operators and Automated Ad Fraud

One of the most revealing aspects of Bitsight’s investigation is the underlying technological infrastructure utilized by the Fengwo Group to execute its fraudulent campaigns at scale. Rather than relying entirely on highly specialized software engineers to code every facet of the operation, the organization reportedly implemented a streamlined, low-barrier workflow designed to minimize operational expenses and maximize output.

According to internal documentation and wiki platforms discovered by researchers, the Fengwo Group leverages a proprietary implementation of Blockly—a Google-built visual programming language originally designed as an educational tool to help children learn software development concepts. By utilizing a drag-and-drop Blockly editor, low-skilled operators within the organization can assemble complex automation routines without needing a deep technical understanding of the underlying JavaScript code.

Once an operator constructs a workflow task—such as launching a headless web browser, navigating specific URL paths, managing browser tabs, or interacting with web elements—the routine is compiled and uploaded to cloud-based storage buckets (such as Amazon S3). Internal communications uncovered by Bitsight highlighted the financial and operational efficiency of this model, with a developer noting that only a small team of advanced programmers is required to build core template execution units, while lower-skilled workers can deploy endless variations of the fraud templates at a fraction of the cost.

When an H96 streaming stick is selected for a task, it downloads the assigned Blockly module. To ensure that ad impressions appear entirely authentic to automated verification systems and human auditors alike, the bot framework integrates multiple vision and reasoning modules. This enables the spoofed devices to accurately identify genuine advertisements on web pages and navigate content with human-like behavioral patterns.

TV On Equals Proxy, TV Off Equals Ad Fraud

Bitsight’s telemetry analysis uncovered a distinct operational schedule governing the behavior of the infected H96 streaming boxes. Researchers observed that the devices dynamically shifted their malicious utility depending on whether the host television was actively in use.

When a user turned on their television—signaled by the presence of an active HDMI connection—the streaming box would immediately cease its automated background tasks and pivot exclusively to functioning as a commercial residential proxy, relaying traffic for anonymous external clients. Conversely, once the television was powered down, the device would transition back to executing ad fraud routines.

Security experts deduce that this careful resource management is intentional. Ad fraud operations, which involve launching web browsers, loading resource-heavy AI-generated web pages, and executing visual automation scripts, are computationally intensive. Running these tasks simultaneously while a user is attempting to stream high-definition video would severely degrade device performance, causing buffering issues, system crashes, or other visible anomalies that might tip off the consumer.

The Economics of Artificial Intelligence and Ghost Networks

The scale of the Fengwo Group’s infrastructure is staggering. Bitsight tracked approximately 38,000 active streaming boxes communicating with a single expired Fengwo telemetry domain. Based on this localized sample, researchers conservatively estimate that this specific ad fraud pipeline generates close to $50,000 in daily revenue—a figure that excludes additional earnings generated from concurrent residential proxy rentals.

Compounding the deception is the nature of the web properties targeted by the bots. The Fengwo Group operates an extensive network of AI-generated websites containing machine-written articles and graphics spanning diverse topics, including finance, health, lifestyle, gaming, music, and food blogs. Notably, Bitsight discovered that these artificial websites displayed advertisements only when visited by a device matching the spoofed mobile profile transmitted by the infected H96 boxes.

Furthermore, the public-facing hub for the Fengwo Group—operating under the domain fwgcloud.com—heavily promotes its capabilities in artificial intelligence, claiming to have developed more than 120,000 "AI digital humans" available for rent for customer service, emotional companionship, and digital design. However, cybersecurity analysts view these grandiose claims with skepticism. They suggest that the "digital human" narrative may serve as an elaborate corporate facade designed to obscure the underlying botnet and ad fraud infrastructure from regulatory authorities and threat researchers.

Efforts by media outlets to independently verify these claims met immediate resistance; inquiries sent to the designated contact address listed on the Fengwo Group’s primary domain bounced back due to overflowing mailboxes, indicating that the operation maintains little to no interest in legitimate public communication or customer support.

Broader Implications and Industry Recommendations

The revelations surrounding the H96 streaming devices and the Fengwo Group underscore a systemic vulnerability within the global Internet of Things (IoT) marketplace. Despite repeated warnings issued by the FBI and cybersecurity agencies regarding the risks of unvetted consumer hardware, major global e-commerce platforms—including Amazon, Best Buy, and Newegg—continue to list and distribute countless iterations of generic media players bundled with unofficial, modified versions of the Android operating system.

These devices frequently arrive pre-infected with malicious packages, lacking proper cryptographic verification, secure boot architecture, or regular firmware updates. Consequently, introducing an unverified streaming box into a home or corporate network compromises the entire local area network, exposing users to bandwidth theft, data exfiltration, and potential legal liabilities stemming from illicit proxy traffic routed through their residential IP addresses.

To mitigate these risks, cybersecurity authorities and major technology providers strongly advise consumers to exercise extreme caution when purchasing streaming hardware. Experts recommend adhering strictly to recognized, reputable consumer brands that maintain official certifications, such as Google TV and Android TV Play Protect compliance. Additionally, organizations like Synthient maintain public repositories tracking known compromised IoT models—ranging from media boxes to digital photo frames—to assist consumers and network administrators in identifying and isolating dangerous hardware.

As automated fraud mechanisms evolve to incorporate artificial intelligence, visual reasoning, and mobile emulation, the security posture of everyday connected devices remains a critical frontline in the defense against transnational cybercrime.