Cheap Streaming Sticks Are Faking Ad Clicks While You Sleep

A researcher at the security firm Bitsight noticed something odd about a batch of cheap television gadgets: they insisted they were telephones.

Pedro Falé had done something clever and cheap. He registered an expired internet domain — a web address whose previous owner had let the registration lapse — that had been quietly used to collect data from a widely sold brand of Android TV box called H96. These are the palm-sized boxes and sticks that plug into a television's HDMI port and are marketed, often by online influencers, as a way to watch every channel and every film for a single up-front payment. When Falé took ownership of the domain, the devices kept reporting in to it, as they had been built to do, and he could read everything they said.

What they said was that they were Samsungs, Vivos, Huaweis and Xiaomis. Tens of thousands of set-top boxes, sitting in living rooms around the world, were describing themselves to a server in China as mobile handsets. As Falé put it to KrebsOnSecurity, which reported his findings this week, something was wildly wrong.

Why a TV box would want to be a phone

The disguise has a commercial purpose. Every device that loads a web page announces what it is — the make of the hardware, the operating system version, the screen size. Advertising networks use that announcement to decide which ads to show and how much they are worth. A phone in the hands of a consumer is a valuable thing to advertisers. A no-name streaming box that nobody is looking at is worth nothing.

Falé found that all the devices reporting in carried the same two apps, published by Zhejiang Fengwo IoT Technology, a mainland Chinese company founded in 2019 that trades as the Fengwo Group. Bitsight traced the money through a chain of shell entities registered in Hong Kong and Singapore, some in the name of a single individual, and found company patents describing more or less exactly what the apps do.

What they do is run an ad fraud operation. Fengwo operates a stable of websites filled with machine-written articles and machine-made images — finance explainers, health tips, education, gaming, music, food blogs — the kind of filler that exists purely to hold advertising. The TV boxes are pointed at those sites and instructed to click the ads, generating payments from advertisers for attention no human ever paid. This particular variant, where the fake interaction is a click on a pay-per-click ad, is known in the trade as click fraud. Tellingly, Bitsight found the sites showed no ads at all unless the visitor matched the fake phone profile the boxes were broadcasting. The audience and the inventory were built for each other.

Fraud as drag-and-drop

The most striking detail is how routine the operation had become internally. Fengwo's engineers built their fraud scripts using Blockly, a visual programming tool Google released to teach children to code, in which you snap coloured blocks together instead of typing. Staff drag blocks to define a task — open a browser silently, load this page, scroll, switch tabs, find and click the ad — and the arrangement is exported as ordinary web code and pushed out to whichever devices are needed. One of the company's own developers is quoted in Bitsight's report explaining the appeal: a handful of skilled engineers build the templates, after which the people churning out fraud routines need very little technical skill, which keeps costs down.

To make the clicking convincing, the operation combines several image-recognition and reasoning systems so the bots can spot an ad in a page layout and move through a site roughly the way a person would. This is what a modern botnet looks like: not a crude flood of traffic, but a workforce of appliances imitating readers.

When the TV is on, your address is for rent

The boxes have a second job. Almost all of these off-brand devices ship with residential proxy software pre-installed — code that rents out your home internet connection to strangers, so their traffic appears to come from your house rather than from a data centre. Buyers of that service range from companies scraping websites at industrial scale to ticket touts to outright criminals. It is a real cost to the owner: the connection slows, and anything unpleasant done through it traces back to their address.

Bitsight found the two schemes politely take turns. When the box detects an HDMI signal — meaning the television is on and someone is presumably watching something — it works as a proxy, which is light on processing power. When the television goes off, it switches to ad fraud, which is demanding enough that it would make the video stutter. The device is careful not to spoil the experience it was bought for.

From telemetry on a single older domain, Bitsight counted about 38,000 boxes and estimated the ad fraud alone brings in close to $50,000 a day, before any proxy income. Falé stresses that this is a deliberately conservative floor. Fengwo's own website, meanwhile, advertises more than 120,000 "AI digital humans" for hire, for companionship or customer service; Bitsight suspects the claim is partly a respectable-looking front. When KrebsOnSecurity emailed the address listed there, the message bounced — the inbox was full.

The devices are still on the shelf

None of this is a novel warning. The FBI has cautioned about these boxes for years, and in January the proxy-tracking service Synthient documented botnets taking over millions of TV devices by chaining together flaws in the proxy software and in the hardware itself. These boxes are typically built on unofficial versions of Android that will never receive a security update, with no meaningful authentication, which makes them a standing liability on a home network — a problem of basic computer security as much as of criminal intent. Even where the manufacturer meant no harm, an abandoned device eventually gets taken over by someone who does.

And yet Amazon, Best Buy, Newegg and others still list hundreds of models. That is the uncomfortable part of the story. The buyers are not the villains here; they are people who wanted to pay once instead of subscribing five times, and the product's actual business model was never disclosed to them. Retailers apply real scrutiny to food and children's toys. Connected electronics that arrive pre-loaded with software designed to defraud third parties and resell the customer's internet connection currently face nothing comparable.

Practical advice is thin but worth having. Google publishes instructions for checking whether a device runs certified Android TV rather than a modified copy, and Synthient maintains a public list of consumer gadgets known to ship with proxy software — a list that reaches beyond streaming sticks to other cheap internet-connected hardware, digital photo frames prominent among them. Stick to recognised brands, install as little as possible on them, and treat a bargain that promises unlimited content for a one-off fee as the sales pitch it is: somebody else is paying for that, and it is you.