Streaming Boxes Hijacked for Ad Fraud

Inexpensive Android streaming boxes can harbor hidden functionalities, according to recent research. These devices may secretly route external internet traffic through a household's connection and engage in activities like clicking online advertisements. One operation, dubbed Fuyao Enterprise by researchers, has been identified as capable of spoofing these boxes to appear as smartphones.

Bitsight researchers uncovered this operation by observing an expired domain that previously managed factory backdoors. They found that some H96 devices, particularly older models, appeared to come pre-installed with Fuyao apps. However, it remains unclear if the apps were added by the manufacturer, a reseller, or a custom firmware provider.

These compromised devices are often Android Open Source Project (AOSP) based, not Play Protect certified Android TV OS devices. This certification is crucial for ensuring security and compatibility. Signs of potential compromise include inexpensive, off-brand boxes, unusual internet activity, and requests to disable Google Play Protect.

The Fuyao software can disguise a TV box as a smartphone to visit operator-controlled websites and click ads, mimicking mobile users. The operation also appears to switch between acting as a residential proxy when the TV is on and performing ad fraud when it is off. Bitsight estimates potential daily ad fraud revenue could reach $47,500 based on observed devices.

Bitsight attributes the Fuyao operation to Zhejiang Fengwo IoT Technology Co., Ltd., operating as Fengwo Group. The company's website advertised over 120,000 "AI digital humans," which researchers interpret as a potential reference to the automated device network. Consumers can protect themselves by choosing reputable brands, verifying Play Protect certification, avoiding unofficial app stores, and considering a separate network for smart devices.