Security experts have long warned about the inherent risks associated with generic TV streaming boxes that promise unlimited content for a one-time fee. Beyond concerns about these devices secretly renting out user internet connections, groundbreaking research now exposes a sprawling operation where these boxes routinely spoof themselves as mobile phones to generate fraudulent ad clicks on AI-generated websites. **Pedro Falé**, a threat researcher with the security firm **Bitsight**, spearheaded the investigation. Falé gained insight into this complex ad fraud network by registering an expired domain name previously used to coordinate fake ad clicks across a particularly popular brand of streaming devices known as **H96**.  Falé discovered that the domain, once used for telemetry, was collecting full hardware information and installed app lists from tens of thousands of H96 streaming sticks globally. Upon inspecting the traffic, a significant anomaly emerged: nearly all the TV boxes transmitting data claimed to be mobile phone models from various manufacturers, including Samsung, Vivo, Huawei, and Xiaomi. “We noticed something was wildly wrong,” Falé stated. “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.’”  The researcher found that all devices had the same two specific apps installed, both developed by **Zhejiang Fengwo IoT Technology Ltd**, a Chinese entity founded in 2019 that operates an ad-publishing portfolio under the name **Fengwo Group**. Further investigation revealed that Fengwo Group holds multiple patents matching the internal mechanisms of these apps. “Bitsight TRACE identified several Hong Kong, Singapore, and single person ‘legal’ shell identities used to collect the monetization and traced the operation back to a mainland China company known as Zhejiang Fengwo IoT Technology Co., Ltd, which operates under the Fengwo Group,” Falé detailed in a recent report. Falé's analysis indicates these apps coordinate an ad fraud network, leveraging H96 devices as a captive traffic source to click on ads hosted on AI-generated websites operated by the Fengwo Group. Bitsight's findings show these websites feature machine-generated news articles and graphics across various categories like finance, health, education, gaming, music, and food blogs. Crucially, these sites only displayed ads if the visiting device matched the spoofed mobile profile of the H96 devices. ## AI Digital Humans and Automated Fraud The Fengwo Group's domain, fwgcloud[.]com, boldly claims to be “redefining the boundaries of human-AI interaction,” boasting over 120,000 “AI digital humans” available for rent for diverse services. This self-proclaimed innovation appears to underpin a highly automated ad fraud scheme.  Falé observed that the Fengwo Group’s domain shared SSL certificate data with other domains linked to the H96 apps, particularly the phone spoofing mechanism. The domain also hosts an internal wiki platform that directly connects the Fengwo Group to a proprietary implementation of **Blockly**, a Google-built visual programming language originally designed to teach children software development. According to Bitsight, Fengwo Group employees utilize Blockly to construct these fraudulent websites. This allows low-skilled operators to drag and drop code blocks in an editor, eliminating the need to understand the underlying code or its functionality.  “An operator can drag blocks together in their Blockly editor, to define each fraud routine, given a task type,” Bitsight’s report explains. “Once the routine is saved, it gets exported as JavaScript and uploaded to the S3 buckets. An operator doesn’t need as much understanding of the underlying technicalities, as it is all set in place for ease of use.” Bitsight even uncovered remarks from a Fengwo Group app developer highlighting these advantages, noting that “only a small number of highly-skilled developers are needed to build the template execution-unit images,” and that “developers who create execution units from those templates have significantly lower technical requirements, greatly reducing the company’s operating costs.” If an H96 streaming stick is selected for a specific fraud task, it receives the appropriate Blockly module. This module enables the device to silently launch a web browser, visit websites, browse pages, manage tabs, and click on ads. To ensure these TV boxes, masquerading as mobile phones, can reliably click ads on AI-generated websites, the Fengwo Group integrates “three vision and reasoning systems into a single interface.” This allows the bots to accurately identify ads and navigate sites much like a human, as detailed in the Bitsight report.  ## Dual Functionality: Proxy When On, Ad Fraud When Off Bitsight's investigation revealed a fascinating operational split: H96 devices either relay residential proxy traffic or engage in ad fraud, but never simultaneously. The researchers concluded that when a TV box detects an HDMI signal from an attached television – indicating active user content streaming – it typically functions as a residential proxy. When the TV is off, the device switches to awaiting ad fraud assignments. Falé suggests this configuration is due to the ad fraud activities being significantly more resource-intensive, which could interfere with the device's primary function of streaming video content. Despite repeated warnings from entities like the **FBI** and cybersecurity industry leaders about the security and privacy risks of these streaming devices, major e-commerce platforms continue to sell numerous models and brands that often bundle unofficial versions of Google's Android operating system. These devices are frequently marketed as a way to access a wide array of streaming services and live broadcasts without subscriptions, often through online influencers.