You can protect your advertising budget and keep your site analytics trustworthy by understanding a newly documented TV box ad fraud network. Cheap streaming boxes that promise free content are quietly disguising themselves as mobile phones and clicking ads on machine-generated websites, which defrauds online merchants and ad networks. The findings come from the security firm Bitsight, whose threat researcher Pedro Falé detailed the operation to KrebsOnSecurity in a report released July 30, 2026.
What happened
According to KrebsOnSecurity, Bitsight threat researcher Pedro Falé examined the network after registering an expired domain that the operation had used for telemetry. Falé said the domain had periodically collected full hardware information and the complete list of installed apps from tens of thousands of H96 streaming sticks plugged into televisions around the world.
When Falé inspected the traffic, nearly every device reporting in claimed to be a mobile phone model from makers including Samsung, Vivo, Huawei and Xiaomi rather than a TV box. "We noticed something was wildly wrong," Falé said, noting that multiple devices reporting to the factory Android TV box backdoor were identifying as phones.
Are you affected?
The operation reaches two groups. Owners of H96 and similar generic streaming devices may have boxes that relay residential proxy traffic and click ads without their knowledge. Advertisers, online merchants and ad networks are the targets of the fraudulent clicks. Bitsight found that the operation's AI-generated sites displayed ads only when the visiting device matched the spoofed mobile profile of these boxes.
If you own a streaming box, Google says you can confirm whether a device runs the official Android TV operating system with Play Protect certification by following its published instructions. Synthient, a proxy tracking service, maintains a running list of IoT devices known to ship with residential proxy software or other malicious apps pre-installed; that list also covers devices beyond streaming sticks, including digital photo frames.
For anyone running ads or reviewing site traffic, the fraudulent clicks arrive from devices posing as mobile phones. Bitsight has not published a method for merchants to identify affected clicks after the fact.
What to do now
- Choose name-brand streaming devices from reputable manufacturers rather than generic boxes sold cheaply with bundled unofficial versions of Android.
- Confirm a device runs the official Android TV OS with Play Protect certification by following Google's instructions.
- Be sparing and careful with any apps you install on a streaming device, since many can bundle residential proxy software.
- Check Synthient's list of IoT devices known to ship with proxy or malicious software before connecting a device to your home or office network.
- Remove insecure, unauthenticated boxes from your network, since the FBI and security researchers have warned these devices invite further compromise.
How the fraud network operates
Falé found all of the devices reported having the same two apps installed, made by a company called Zhejiang Fengwo IoT Technology Ltd, an entity founded in 2019 in mainland China that runs an ad-publishing portfolio under the name Fengwo Group. Bitsight TRACE said the group registered patents matching the inner workings of the apps and used shell identities in Hong Kong and Singapore to collect the monetization.
The ads sit on websites filled with machine-generated news articles and graphics across finance, health, education, gaming, music and food categories. Bitsight reported that the group's employees build these sham sites with Blockly, a Google-built visual programming language originally designed to teach children to write software. Operators drag blocks of code together to define each fraud routine, which is then exported as JavaScript and uploaded to storage buckets, so workers do not need to understand the underlying code.
When an H96 stick is selected for a task, Bitsight said it receives a module that can silently launch a web browser, visit sites, browse pages, manage tabs and click ads. To make the boxes click reliably while posing as phones, the report said the operation fuses three vision and reasoning systems into one interface so the bots identify an ad and navigate a page much like a person would.
Bitsight found the boxes either relayed residential proxy traffic or ran ad fraud, but never both at once. When the device detected an HDMI signal from an attached television, meaning the user wanted to stream video, it usually worked as a residential proxy. With the television off, it switched back to waiting for ad fraud jobs. Falé said the boxes are set up this way because the ad fraud work is resource-intensive and could interfere with streaming.
How large is the operation?
Bitsight tracked roughly 38,000 TV boxes phoning home to the expired Fengwo Group domain and, based on that figure, estimated the ad fraud network brings in close to $50,000 a day, not counting revenue from the residential proxy side. Falé stressed the estimate is conservative and drawn from one older domain.
The Fengwo Group's domain, fwgcloud.com, claims the company created more than 120,000 AI digital humans available to rent for roles from companionship to customer service. Bitsight's report concludes this could be marketing or a way to avoid suspicion, a pattern the firm said it has seen with proxy and DDoS operations that hide their true purpose. KrebsOnSecurity said it emailed the contact address on the company's homepage, and the message bounced back because the inbox was full or overloaded.
Major retailers including Amazon, Best Buy and Newegg continue to sell hundreds of these off-brand models, which are often marketed through online influencers as a way to watch streaming services without a subscription. In January, Synthient documented how multiple botnets rapidly took over millions of TV boxes through vulnerabilities in both the proxy software and the streaming devices themselves.
FAQ
What is the H96 and why is it a concern?
H96 is a brand of generic Android TV streaming device. Bitsight found H96 boxes spoofing mobile phone models from makers such as Samsung, Vivo, Huawei and Xiaomi and clicking ads on AI-generated websites, while also relaying residential proxy traffic when a television was in use.
How much money did the fraud network make?
Bitsight tracked about 38,000 boxes reporting to one older domain and estimated the ad fraud brought in close to $50,000 a day, not counting residential proxy revenue. Falé described the estimate as highly conservative.
How can I tell if my streaming device is legitimate?
Google says you can confirm whether a device runs the official Android TV OS with Play Protect certification by following its instructions. Synthient also maintains a list of IoT devices known to ship with residential proxy software or other malicious apps pre-installed.