The clever part is the HDMI check. A cheap Android TV box knows whether you are watching, because it can see whether the television on the other end of the cable is powered on. Researchers at Bitsight found a family of these devices using that one signal to decide which crime to commit. TV on, and the box quietly rents your home internet connection out as a residential proxy. TV off, and it spends the night visiting AI-generated fake news sites and clicking the ads.
Security journalist Brian Krebs published the findings on July 30, 2026. The operation traces to Zhejiang Fengwo IoT Technology Ltd, a mainland China company operating as Fengwo Group. Bitsight researcher Pedro Falé tracked roughly 38,000 devices worldwide phoning home to just one of the group's older domains, and estimates the ad fraud alone brings in around $50,000 per day. The hardware sells under the H96 label and a rotating cast of similar names, on Amazon, Best Buy, Newegg and most other large retailers.
RelatedOpenAI's Models Escaped a Sandbox and Hacked Hugging Face
Why does the HDMI trick matter?
Because it is an anti-detection measure disguised as politeness. Malware that saturates a home connection at 8pm gets noticed. Someone calls their ISP, resets the router, eventually unplugs the mystery box under the television. Gating the heavy work on the TV being off means the owner's actual experience never degrades, so the device stays plugged in and earning for years.
It also lines up neatly with what each fraud type is worth. Residential proxy buyers want traffic that looks like a real person at a real house during real waking hours, which is exactly when your TV is on. Ad fraud does not care what time it is and wants uninterrupted throughput, which is exactly when your TV is off. The device is not switching between modes because it has to. It is switching because that is when each stream pays best.
How does the ad fraud actually work?
The boxes pull instructions as Blockly-based commands, meaning the operators push new task definitions as visual block programs rather than shipping a new firmware build every time a campaign changes. The device then presents itself as a mobile phone, spoofing Samsung, Vivo, Huawei and Xiaomi handsets, and browses websites built to hold ad inventory and nothing else. Those sites are AI-generated fake news, which is the detail worth sitting with: one automated system writes the pages, another automated system pretends to read them, and a real advertiser pays for both.
Krebs reports the operation runs three vision and reasoning systems to find and click ads the way a person would. That is the part that makes this expensive to stop. Ad fraud detection has historically leaned on behavioral tells, because scripted clickers move wrong: too fast, too precise, straight to the ad. A system that looks at the rendered page and decides where a human would click defeats most of that, and it does it from a residential IP on a device with a plausible phone fingerprint.
What should you actually do?
If there is a no-name streaming box in your house, the honest answer is that you cannot clean it. There is no scanner for this, the malware is in the firmware image the device shipped with, and a factory reset restores the compromised image. Practical steps, in order of how much they help:
- Check whether the device is a certified Android TV build. Google publishes instructions for verifying certification. An uncertified box running something that merely resembles Android TV is the entire risk category described here.
- Cross-reference Synthient's public list of compromised IoT devices before you buy, and against anything already plugged in.
- Prefer devices from an established brand with a real update channel. Roku, Apple, Google, Amazon and the streaming stacks built into major TV brands are not immune to bad behavior, but they are not shipping ad-fraud firmware from the factory.
- Segregate anything you keep. Putting untrusted devices on a guest network limits what a residential proxy can reach on your LAN, even if it does nothing about the fraud itself.
- Be sparing with sideloaded apps. Krebs's own closing advice, and it applies even to legitimate hardware.
What separates a safe box from a risky one?
| Generic box (H96 class) | Certified Android TV | Roku / Fire TV / Apple TV | |
|---|---|---|---|
| Who built the firmware | Unnamed ODM, no audit trail | Licensed OEM, Google-certified | Platform vendor |
| Security update channel | None after purchase | Vendor-supplied | Automatic |
| Passes Play Protect certification | No | Yes | Own equivalent |
| Typical retail price | $25 to $45 | $50 to $120 | $30 to $150 |
| Business model | Hardware sold below cost | Hardware margin | Hardware plus platform revenue |
| Reset removes malware | No, it is in the image | Not applicable | Not applicable |
That fourth row explains the other five. A box that sells for $25 with a power supply, remote and shipping included is not making money on the sale. Something has to pay for it, and in this case the buyer is paying with their IP address.
RelatedFortiBleed Exposed Credentials for 86,000 Fortinet Firewalls
Who is exposed beyond the device owner?
Advertisers, first and most directly, since they are funding the whole thing at roughly $50,000 a day from one operator. But residential proxy traffic causes a broader mess. Fraud teams at banks and retailers treat home IP addresses as a trust signal, which is precisely why proxy access sells. When 38,000 real households are quietly reselling that signal, every downstream system relying on it gets less reliable, and the eventual correction tends to land on ordinary users who suddenly fail a risk check they have no way to see or appeal.
- Whether retailers delist. Amazon, Best Buy and Newegg all carry this hardware. Named research usually moves listings faster than regulators do, and it is the fastest available lever.
- CISA or FCC involvement. Preinstalled firmware from a named foreign vendor at this scale fits the pattern of past FCC equipment actions. Nothing has been announced.
- Detection catching up to vision-based clicking. If reasoning models can click like humans from residential IPs, behavioral ad-fraud detection loses much of its edge, and the industry will need something other than movement heuristics.
- The 38,000 number growing. That count came from a single older domain. The real fleet is very likely larger, and future disclosures will tell us by how much.
Our take
Treat the price tag as the security disclosure. Everyone already knows that free apps monetize you, and this is the same arrangement wearing a $30 plastic shell. The supply chain here is not really broken, it is working exactly as designed by the people who built it: sell the hardware at or below cost, recover the difference from the buyer's bandwidth and reputation, and let a major retailer's listing page supply the trust.
What is genuinely new is not the fraud model but the competence of it. HDMI-gated scheduling, Blockly task delivery, phone fingerprint spoofing and vision-based ad clicking are four independently sensible engineering decisions, and the combination is better product thinking than a lot of legitimate IoT. The uncomfortable conclusion is that the economics of ad fraud now support a real engineering team, and detection built for scripted clickers is aiming at a problem that no longer exists.
- ResearchKrebsOnSecurity: Read this before you buy that TV streaming stick — device counts, revenue estimate and the Fengwo Group attribution
- ResearchBitsight security research — Pedro Falé's underlying technical analysis of the device fleet
- OfficialGoogle: Android TV certified devices — how to verify a box runs a certified build rather than a lookalike
- ReferenceGENZ TECH CVE Watchlist — the vulnerabilities we are currently tracking as actively exploited
Original analysis by GenZTech, built from Brian Krebs's report on compromised streaming devices published July 30, 2026, citing Bitsight research.