Read This Before You Buy That TV Streaming Stick
Caution: The Hidden Cost of "Free" Streaming Sticks
For years, cybersecurity professionals have warned consumers against purchasing generic, off-brand TV boxes. These devices often lure buyers with the promise of unlimited free content for a single upfront payment, but the real price is paid in security. While it was already known that these boxes often secretly lease the owner's bandwidth to third parties, a new investigation reveals a much more sinister operation.
The Discovery: More Than Just a Proxy
A recent deep-dive analysis has uncovered that these devices are being used in a massive ad-fraud scheme. The hardware doesn't just steal your internet; it actively masquerades as a fleet of mobile smartphones to click on advertisements on AI-generated websites, defrauding advertisers and merchants on a global scale.
Pedro Falé, a threat researcher at the security firm Bitsight, uncovered this network through a clever bit of digital detective work. He registered an expired domain that had previously been used to coordinate these activities for a popular brand of streaming sticks known as H96.
How the Investigation Unfolded
Falé discovered that the domain he acquired was once a telemetry hub. It collected detailed hardware specs and app lists from tens of thousands of H96 devices worldwide. However, the data revealed a glaring inconsistency: the TV boxes were lying about what they were.
"We noticed something was wildly wrong," Falé explained. "Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.’"
The devices were spoofing their identities to appear as various mobile handsets:
| Spoofed Manufacturer | Device Category |
|---|---|
| Samsung | Mobile Phone |
| Vivo | Mobile Phone |
| Huawei | Mobile Phone |
| Xiaomi | Mobile Phone |
The Architect: Fengwo Group
The investigation traced the malicious apps on these devices back to a Chinese entity called Zhejiang Fengwo IoT Technology Ltd (operating as the Fengwo Group), established in 2019.
To hide their tracks and collect profits, the group utilized a complex web of shell identities:
- Single-person "legal" shells.
- Front companies in Singapore.
- Front companies in Hong Kong.
The Ad Fraud Engine
The Fengwo Group creates a closed-loop ecosystem for fraud. They use AI to generate fake news sites and blogs covering topics like health, finance, gaming, and food. These sites are designed so that ads only appear when the visitor matches the specific spoofed mobile profile of an H96 device.
The Role of "AI Digital Humans"
The company's official domain, fwgcloud[.]com, claims they are pioneers in human-AI interaction, boasting over 120,000 "AI digital humans" for rent. However, the underlying infrastructure is tied directly to the phone-spoofing mechanisms found on the H96 sticks.
The Technical Pipeline: Blockly and Automation
One of the most surprising findings was the use of Blockly, a visual programming language developed by Google (originally for children). The Fengwo Group uses Blockly to allow low-skilled employees to build fraud routines without needing to write complex code.
// Conceptual flow of a fraud routine
if (device.status == "idle") {
launchBrowser();
navigateTo(ai_generated_site);
identifyAd(vision_system);
clickAd();
}
The workflow operates as follows:
- Design: An operator drags and drops blocks in the Blockly editor to define a fraud task.
- Export: The routine is converted into
JavaScript. - Deployment: The code is uploaded to S3 buckets.
- Execution: The H96 device downloads the module and executes tasks like managing tabs or clicking ads.
To make the bots seem human, the group integrates three different vision and reasoning systems, allowing the software to "see" the ad and navigate the page realistically.
The "Dual-Purpose" Logic
Bitsight found that the H96 devices are versatile in their malice. They don't perform ad fraud and residential proxying simultaneously; instead, they switch based on the user's activity.
The logic can be expressed as:
In plain English:
- TV is ON: The device acts as a proxy, renting your IP to strangers.
- TV is OFF: The device switches to a bot, clicking ads to make money for the Fengwo Group.
Final Warning
Whether it is the FBI's warnings about IoT devices or the findings of Bitsight, the message is clear: if a streaming device offers "everything for free," you aren't the customer—you are the product.
