For years, cybersecurity experts have issued a recurring warning to consumers: those "too good to be true" generic TV streaming boxes—often marketed as providing free access to unlimited premium content for a single, low-cost fee—are not just gray-market entertainment devices. They are, in fact, sophisticated digital Trojan horses.
A groundbreaking investigation by the security firm Bitsight has now unmasked the true scale of this threat. Beyond merely hijacking home internet connections to sell as residential proxies, these devices are routinely spoofing mobile phone identities to automate large-scale ad fraud on AI-generated websites. This sprawling criminal operation, linked to a mainland Chinese entity, is defrauding advertisers and merchants on a global scale, turning millions of unsuspecting living rooms into nodes for a massive botnet.
The Discovery: Peering into the H96 Botnet
The investigation, spearheaded by Pedro Falé, a threat researcher at Bitsight, began with a strategic move: the registration of an expired domain previously used for telemetry by the "H96" brand of streaming devices. These devices are ubiquitous on major e-commerce platforms, including Amazon and Newegg, often promoted by social media influencers as the ultimate "cable-cutting" solution.
When Falé gained control of the telemetry domain, he expected to see basic hardware diagnostics. Instead, he uncovered a complex, high-traffic data stream. Tens of thousands of H96 boxes were checking in, transmitting hardware logs and app lists. However, the metadata revealed a startling discrepancy: despite being stationary TV peripherals, nearly every device identified itself as a high-end mobile smartphone, spoofing models from manufacturers such as Samsung, Vivo, Huawei, and Xiaomi.
"We noticed something was wildly wrong," Falé told KrebsOnSecurity. "Multiple devices reporting to this factory Android TV Box backdoor were claiming to be mobile phones."
Chronology of an Ad Fraud Empire
The operation traces back to Zhejiang Fengwo IoT Technology Ltd, an entity established in 2019. Bitsight’s forensic analysis of the software pre-installed on the H96 devices identified two core applications developed by this group. By tracking the monetization infrastructure, investigators traced the operation through a web of shell companies in Hong Kong and Singapore, ultimately landing on the mainland Chinese firm, which operates under the brand name Fengwo Group.
The Evolution of the Scam:
- 2019: Zhejiang Fengwo IoT Technology is founded, beginning the development of its app portfolio.
- 2021–2024: The company scales its operations, embedding its software into low-cost Android TV boxes during the manufacturing process.
- 2025: The FBI issues formal warnings regarding the risks of home IoT devices, specifically noting their propensity for hosting malicious proxies.
- Early 2026: Researchers at Synthient document the "Kimwolf" botnet, which enslaved millions of these devices.
- Mid-2026: Bitsight’s investigation confirms the transition from simple proxy-relaying to active, AI-orchestrated ad fraud.
Supporting Data: The Mechanics of the Fraud
The Fengwo Group has created a remarkably efficient ecosystem for digital larceny. The H96 devices act as a captive traffic source, silently launching browsers, navigating web pages, and clicking on advertisements.
The Blockly Automation Engine
The heart of this operation is a proprietary implementation of Blockly, a visual programming language originally designed by Google to teach children the fundamentals of software engineering. By utilizing Blockly, Fengwo allows low-skilled operators to drag and drop "code blocks" to define fraud routines. These routines are exported as JavaScript and deployed to cloud-based S3 buckets.
This democratization of cybercrime means that the Fengwo Group does not need an army of senior engineers. A small team of core developers maintains the system, while lower-level employees execute the fraud templates at a negligible cost.
AI Digital Humans
The group’s public face, fwgcloud[.]com, boasts of "redefining human-AI interaction," claiming to offer over 120,000 "AI digital humans" for services ranging from customer support to design. Bitsight’s research suggests this is largely a facade—a "digital camouflage" designed to provide the company with a veneer of legitimacy.
However, the "AI" aspect is very real in the context of the fraud. The bots are programmed to simulate human behavior, fusing vision and reasoning systems to accurately identify advertisements and navigate sites. They only display ads when the visiting device matches the spoofed mobile profile, effectively tricking ad networks into paying out for "premium" mobile traffic that is, in reality, coming from a cheap plastic box in someone’s den.
The Dual-Mode Trap: Proxy vs. Fraud
Bitsight discovered that these devices operate in a binary "toggle" state. When a user is actively watching television—signaled by an active HDMI handshake—the device functions primarily as a residential proxy, selling the user’s bandwidth to third parties.
When the television is powered off, the device shifts into "ad fraud mode." This division of labor is strategic: ad fraud is resource-intensive and would likely cause lag or buffering if performed while the user was streaming video. By separating the tasks, the operators maximize profit while keeping the device functional enough to avoid being discarded by the owner.
Official Responses and Industry Implications
The implications for the average consumer and the digital advertising industry are severe. For the consumer, these devices are a gaping security hole. They lack authentication, are rarely patched, and grant external actors a "front door" into the local home or office network.
The FBI’s position remains firm: "Home internet-connected devices facilitate criminal activity." Despite this, major retailers continue to profit from the sale of these uncertified, insecure devices. While Google provides a "Play Protect" certification for Android TV, many of these devices ship with modified, unofficial firmware that bypasses these safety checks.
When reached for comment by security researchers, the Fengwo Group remained silent. Attempting to contact the company through its provided email resulted in a bounce-back notice: "Their inbox is full, or it’s getting too much mail right now."
Mitigating the Risk
As the industry grapples with the rise of AI-automated botnets, the path forward for consumers is clear:
- Stick to Trusted Hardware: Purchase streaming devices from reputable manufacturers (e.g., Google, Roku, Apple, Amazon Fire TV) that maintain clear update policies.
- Verify Certification: Ensure that any Android-based device is Google Play Protect certified.
- Network Segmentation: For advanced users, place IoT devices on a "guest" or isolated VLAN to prevent them from accessing sensitive devices like PCs or NAS drives on the local network.
- Audit Your Network: Tools like those maintained by Synthient provide lists of known compromised devices. If your hardware is on the list, it is best to factory reset the device or, ideally, disconnect it permanently.
The Fengwo Group incident serves as a stark reminder that in the hyper-connected era of the Internet of Things, the price of "free" is often your own digital security. As long as these boxes are sold in the millions, they will remain the engine room of a global, invisible, and highly profitable fraud machine.
