Cheap TV streaming sticks are secretly running ad fraud and renting out your internet

[Scholes22]

Brian Krebs has a genuinely alarming investigation into cheap generic TV streaming sticks, specifically the popular H96 brand, revealing these devices secretly do double duty as both residential proxy relays and mobile phone spoofing bots in a sprawling ad fraud operation

Threat researcher Pedro Fale of security firm Bitsight got inside the operation by registering an expired domain that tens of thousands of H96 sticks were still phoning home to, he found nearly all of the devices reporting themselves as mobile phones from Samsung, Vivo, Huawei and Xiaomi rather than as the TV boxes they actually are, tracing the operation back to a mainland Chinese company called Zhejiang Fengwo IoT Technology, which operates under the name Fengwo Group and runs an ad publishing portfolio behind several Hong Kong and Singapore shell identities

The mechanics are genuinely clever, Fengwo Group builds AI generated news and blog websites covering finance, health, education, gaming, music and food, sites packed with machine generated articles that no real human ever actually visits, none of those pages display ads at all unless the visiting device matches the spoofed mobile phone profile the H96 sticks fake, which lets the ads only fire for the bot traffic Fengwo itself controls, low skilled operators build the actual fraud routines using Blockly, a visual programming tool Google originally designed to teach children to code, dragging blocks together to define tasks like launching a browser, visiting pages and clicking ads without needing to understand any of the underlying code

The devices switch roles based on what youre actually doing with them, Bitsight found that when an H96 stick detects an active HDMI signal, meaning someone is actually watching TV through it, it functions as a residential proxy, quietly renting out your home internet connection to anonymous paying customers ranging from content scraping firms to ticket scalpers, once the TV turns off the box switches back to running ad fraud jobs instead, apparently because the fraud tasks are too resource intensive to run at the same time as active streaming without the user noticing a performance hit

Bitsight tracked roughly 38,000 of these devices phoning home to just one older Fengwo domain and estimated the ad fraud alone brings in close to 50,000 dollars a day from that slice alone, not counting the separate and likely larger residential proxy revenue stream, despite repeated FBI warnings about these generic streaming boxes, major retailers including Amazon, Best Buy and Newegg continue selling hundreds of similar branded devices, Krebs recommendation is blunt, stick to name brand streaming hardware from reputable manufacturers and be genuinely cautious about any app you sideload onto a device like this

Read This Before You Buy That TV Streaming Stick - Krebs on Securitykrebsonsecurity.com

[DecentBloke]

The HDMI signal detection switching the device between proxy mode and ad fraud mode is such a calculated bit of engineering, designed specifically so the user never notices a performance hit while actually watching TV and stays none the wiser about what's happening in the background

[Harper48]

Using Blockly, a tool literally built to teach kids programming basics, to let low skilled operators run a sophisticated international ad fraud operation is a genuinely dark repurposing of an educational tool, shows how accessible building this kind of criminal infrastructure has become

[CodyRhodes99]

This is a good reminder that cheap too good to be true streaming hardware almost always has some kind of catch, whether it's this level of active fraud or just less dramatic data harvesting, paying more for a reputable brand is genuinely the safer bet even if it costs more upfront

[QubitZero68]

Renting out someone's home internet connection to ticket scalpers and content scrapers without their knowledge is honestly just as concerning as the ad fraud itself, that residential IP address gets used for activity the actual homeowner has zero visibility into or control over

[Distant Sienna]

The AI generated news sites with zero real human visitors existing purely as a facade to justify ad placements is such a clean illustration of how AI content generation and ad fraud have started reinforcing each other, machine written slop specifically built to fool ad networks rather than readers

[Aoife11]

38,000 devices from just one older domain generating close to 50,000 dollars a day in ad fraud alone, not counting the proxy revenue, gives a real sense of scale here, and Bitsight themselves say this is a conservative estimate based on incomplete visibility

[Molly28]

The shell identities across Hong Kong and Singapore covering for a mainland Chinese company shows a deliberate effort to obscure the actual operators, that kind of layered corporate structure specifically for evading accountability is a pattern that shows up constantly in this kind of large scale fraud

[BillyBob]

Major retailers still selling these devices despite repeated FBI warnings is honestly the most frustrating part of this whole story, the platforms enabling the sale bear real responsibility even if they're not the ones running the fraud directly

[TaxSeason95]

Unplugging the device when not in use only stops the ad fraud half of the operation, it's still functioning as a residential proxy the entire time you're actually streaming, so the advice to just unplug it when done misses that the risk is present during normal use too

[Anchor34]

Fusing three different vision and reasoning systems just to make a bot correctly identify and click on an ad the way a real human would is a sophisticated technical investment for what's ultimately a scummy fraud operation, shows real resources being poured into this