A Dark Secret Lurking in Your Living Room: TV Streaming Sticks Caught in Massive Ad Fraud Scheme
Cybersecurity experts have long warned about the risks of using generic TV boxes for streaming, but a recent investigation has uncovered a shocking twist. These devices not only rent out your internet connection to strangers but also secretly participate in a sprawling ad fraud operation that defrauds online merchants and advertising networks.
Pedro Falé, a threat researcher with Bitsight, stumbled upon this complex scheme while analyzing an expired domain name used to coordinate fake ad clicks on H96 TV streaming devices. His investigation revealed that these devices were spoofing themselves as mobile phones, clicking ads on AI-generated websites created by the Fengwo Group, a company based in mainland China.
Falé’s research showed that nearly all of the H96 devices transmitting data claimed to be mobile phone models from various manufacturers, including Samsung and Huawei. Upon further inspection, he found that these devices were reporting having the same two apps installed – both made by Zhejiang Fengwo IoT Technology Ltd, an entity founded in 2019 with a portfolio of ad-publishing services.
The investigation revealed that the Fengwo Group has registered multiple patents matching the inner workings of these apps. Bitsight’s analysis found that the group uses a visual programming language called Blockly to build sham websites, allowing low-skilled operators to create complex fraud routines without needing to understand underlying code.
This scheme is particularly concerning because it allows even inexperienced operators to participate in massive ad fraud operations. The Fengwo Group’s employees use Blockly to build and deploy these fake websites, which then click on ads on behalf of the H96 devices. This creates a vast network of fake traffic, generating revenue for the group at the expense of online merchants and advertising networks.
The implications of this discovery are significant. If you own an H96 TV streaming device or any other generic box, it’s essential to understand that your internet connection may be used in these ad fraud schemes without your knowledge. While the scope of this operation is still unclear, one thing is certain: users should exercise extreme caution when using such devices and be aware of the potential risks.
To mitigate these risks, we recommend that users take a closer look at their streaming devices and apps installed on them. If you have an H96 device or any other generic box, make sure to regularly review your app permissions and keep your device’s software up-to-date. It’s also essential to use strong passwords and enable two-factor authentication to prevent unauthorized access to your accounts.
Ultimately, this discovery highlights the need for greater transparency in the streaming industry. As users, we must demand more from manufacturers and service providers regarding data collection and usage practices. By staying informed and vigilant, we can protect ourselves and our online activities from these types of threats.
Source: Krebs on Security — 2026-07-30