What Every Buyer Must Know About TV Streaming Stick Ad Fraud

TV streaming stick threats exposed

Security researchers have long warned that cheap TV streaming sticks sold on marketplaces can turn a household TV into a covert ad‑click farm. New findings by Bitsight reveal that a popular model, the H96, not only rents the user’s broadband as a residential proxy but also masquerades as a mobile phone to flood AI‑generated sites with fraudulent clicks.

“Multiple devices reporting to this factory Android TV Box backdoor were ‘phones,’” says Pedro Falé, threat analyst at Bitsight.

Falé registered the expired domain fwgcloud[.]com, previously used for telemetry, and discovered it was pulling full hardware specs and app inventories from tens of thousands of sticks worldwide. The data showed every unit advertised itself as a Samsung, Huawei, Vivo or Xiaomi handset.

Fake apps and the Fengwo Group

Two pre‑installed apps, authored by Zhejiang Fengwo IoT Technology Ltd, were present on every compromised stick. Fengwo, a Chinese firm that markets “AI digital humans,” uses a visual‑block language called Blockly to let low‑skill operators assemble ad‑click scripts without coding expertise.

When a stick detects an active HDMI signal it behaves as a residential proxy, renting the IP address to scrapers and scalpers. ↓ 38,000 devices were observed idle when the TV is off, ready to receive a Blockly payload that launches a browser, navigates to a sham site, and clicks an ad.

The sham sites, hosted on the same SSL certificate as fwgcloud[.]com, publish AI‑written articles on finance, health and gaming, but display ads only to the spoofed mobile profiles. Bitsight estimates the operation nets ↑ $50,000 daily from click fraud alone.

Federal warnings from the FBI and multiple security firms have urged consumers to avoid unofficial Android TV boxes. Yet major retailers continue to list dozens of models, often promoted by influencers as a “one‑stop streaming solution.”

For those who already own a stick, Google advises checking for the official Android TV OS and Play Protect certification Google support. Independent researchers such as Reuters have documented similar IoT botnet abuse across digital photo frames and other cheap devices.

Intel provided by Nova Stirling (Aerospace & Space Tech Correspondent).