Security researchers have discovered that some inexpensive, uncertified Android TV boxes are secretly performing ad fraud and acting as residential proxies.
Many consumers seeking affordable entertainment options turn to inexpensive Android-based streaming boxes, often drawn in cybersecurity firm Bitsight have uncovered a troubling reality: some of these budget devices are performing unauthorized tasks in the background, far removed from simple media playback. These devices have been found to covertly route external internet traffic through the user’s home network and engage in sophisticated ad fraud schemes.
The operation, identified n for uncertified streaming hardware. these boxes interact with AI-generated websites to click on advertisements, generating illicit revenue for the operators behind the scheme. Because this activity occurs silently, the device owner often remains completely unaware that their internet connection is being exploited to facilitate cybercrime.
The sophistication of the Fuyao infrastructure suggests a highly organized effort. Researchers discovered that the malicious software could distinguish between periods of active use and inactivity. When an HDMI signal detected that a user was watching television, the box often prioritized acting as a residential proxy, allowing third parties to route their traffic through the home’s IP address. When the television was powered off, the device would shift its focus to automated ad fraud, utilizing computer vision and customized programming tools to navigate websites and click advertisements.
Bitsight attributed this activity to Zhejiang Fengwo IoT Technology Co., Ltd., noting that the scope of the operation is significant. In a limited sample size, researchers identified tens of thousands of unique device MAC addresses involved in the scheme. While the researchers focused on older H96 Max V11 models, they emphasized that the threat likely extends to other hardware that utilizes similar firmware backdoors. This allows the operators to potentially generate hundreds of thousands of dollars in fraudulent advertising revenue daily.
A critical distinction exists between these compromised boxes and devices running the official Android TV operating system. Google has clarified that the affected hardware uses the Android Open Source Project (AOSP) code, meaning they are not Play Protect certified. Play Protect certification ensures that a device has passed rigorous security and compatibility tests. Without this certification, Google has no record of the device’s security status, leaving consumers vulnerable to preinstalled malware that cannot be easily removed.
Because the malicious software is often embedded directly into the device's firmware, a standard factory reset is frequently ineffective at eliminating the threat. This makes the initial purchase decision the most important defense. Consumers are strongly advised to avoid "fully loaded" or unofficial streaming boxes and instead opt for products from reputable manufacturers that provide consistent security updates and transparent support documentation.
If you suspect an uncertified device is acting maliciously on your network, immediate action is required. First, disconnect the device from both the internet and your television. Review your router’s administrative interface to identify and remove any unrecognized connected devices, and consider updating your Wi-Fi password. If you must use such devices, placing them on a dedicated "guest" or "IoT" network can prevent the box from communicating with sensitive computers or storage drives on your primary network.