IoT Security

Fuyao: The Android TV Ad-Fraud Botnet Now Has a Name and an Operator

The cheap Android TV boxes that pose as phones to click ads now have a name — Fuyao — and an attributed operator, Zhejiang Fengwo IoT. Bitsight's forensic trail, the machine-vision fraud engine, and why the headline device counts are softer than they look.

The cheap Android TV box that disguises itself as a Samsung phone to click ads is not a new story for readers here. What changed this week is that the operation running it now has a name — and a company attached to it. Researchers at Bitsight are calling the botnet Fuyao, and they attribute it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland-China firm founded in 2019. That moves the story from “some off-brand boxes misbehave” to a named commercial enterprise with patents, a publishing network, and a traceable revenue chain.

We covered the underlying mechanic on July 30 — how one popular streaming box rents out your home internet when the TV is on and clicks ads on machine-generated websites when it’s off. This follow-up is not that two-job trick again. It is the attribution Bitsight built, the machinery running underneath the fraud, and a caution about the eye-catching numbers now circulating with the name. As The Hacker News summarized this week, the same apps rewrite a box’s hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo handsets, then click ads on sites the operators themselves run.

From a Loose “Fengwo Group” to a Named Enterprise

The earlier reporting gestured at an ad-publishing operation called Fengwo Group. Bitsight’s contribution is to pin the whole apparatus to a single corporate identity and show the plumbing. Its attribution rests on shared TLS certificate data, exposed internal wiki files, reused email addresses, revenue links, and patents — a convergence of signals rather than one smoking gun. Public Chinese patent records independently list Zhejiang Fengwo as the assignee of related “digital-human” execution and monitoring technologies: CN117421142B, granted in November 2024, covers execution-flow tracking for digital-human behavior modules, and CN117478834A describes monitoring remote screens through cloud-hosted thumbnails and keyframe comparison. Worth flagging plainly: neither patent mentions advertising, and — Bitsight and THN both say so — the records do not establish that the company operated Fuyao or committed ad fraud. The corporate link is well-evidenced; the criminal conclusion is Bitsight’s assessment, not an adjudicated fact.

The part that makes the operation self-dealing rather than ordinary click fraud is where the money lands. Bitsight mapped 144 operator-owned domains across seven beneficiary clusters; at least 84 of them loaded a Taboola advertising tag on the homepage. Using Taboola’s public sellers.json file, the researchers connected those domains to revenue-collecting entities in Hong Kong and Singapore that trace back to Fengwo. In other words, the botnet clicks ads on websites its own operators publish, and the operators collect the payout. The fraud pays the people who built it.

● THE SELF-DEALING LOOP

The fraud pays the same people who built it.

THE AD-FRAUD CIRCUIT

A Fuyao-infected Android TV box rewrites its hardware identity to mimic a Samsung, Huawei, Xiaomi, or Vivo phone.
Disguised as that handset, it clicks ads — but only on the roughly 144 websites the same operators run, pages that serve ads solely to devices matching the spoofed profile.
Those clicks bill advertisers through a Taboola publishing tag placed on the operator-owned domains.
Revenue routes, via Taboola’s public sellers.json entries, to collecting entities in Hong Kong and Singapore tied back to Zhejiang Fengwo.

THE SECOND JOB

When the TV is switched on and the box detects an HDMI signal, it stops ad-clicking and instead relays strangers’ web traffic through the owner’s broadband as a SOCKS5 residential-proxy exit node.

Source: Bitsight analysis by Pedro Falé, as reported by The Hacker News, July 31, 2026.

The Machinery Behind the Fake Phones

The disguise is not a crude user-agent swap. Bitsight found the command-and-control server pushes a complete phone profile to each device, merging a base configuration with a per-model diff and deleting the chipset properties that would otherwise expose a Rockchip, Amlogic, or Allwinner board underneath. The result is a TV box that reports itself as a specific, plausible handset all the way down.

The fraud logic is assembled the way a hobbyist builds a game. Operators use a custom editor built on Blockly — Google’s drag-and-drop programming framework, originally made to teach children to code — snapping together blocks that launch a browser, open a page, manage tabs, and click an ad. Each routine exports as JavaScript, uploads to S3, and ships to the box. To actually find the ad on screen, the box runs machine vision: a YOLOv8s object-detection model named lourui_2, trained on 12 screen elements including generic banner regions and Taboola widgets, combined with Android accessibility data and Google ML Kit optical character recognition. Across four test devices, Bitsight captured about 40 fraud tasks spanning 21 campaigns and 166 modules. The defender-relevant point is the intent behind all of it: the traffic is engineered to look like a real person, on a real phone, on a real home connection — defeating the two checks programmatic buyers lean on most, device type and IP reputation.

Why the Headline Numbers Are Softer Than They Look

The naming has arrived with big figures, and they deserve a skeptic’s eye. In one day, after filtering for devices carrying the Fuyao apps, Bitsight’s sinkhole received 65,957 reports from about 38,000 unique MAC addresses — but the company cautioned its view skewed toward older models from one brand, and because the system can rotate spoofed identifiers, that is not a confirmed device count. The widely repeated “120,000 AI digital humans” is Fengwo’s own marketing claim, not a measured fleet. On revenue, Bitsight modeled gross returns at $1.25 per device per day — roughly $47,500 daily if 38,000 devices were active — and separately floated that annual revenue could reach $40 million at the advertised fleet size, assuming a 30–40% fraud-flagging rate and a 70% ad-fill rate, without showing the full calculation. Treat all three numbers as order-of-magnitude estimates, not audited totals. The confirmed core is the mechanism and the attribution; the scale is Bitsight’s modeling.

What Defenders Should Actually Do

If you own a cheap Android TV box or HDMI stick — the “lifetime free streaming, one-time fee” kind — the guidance from our earlier piece still holds and is worth acting on: there is no light or setting that tells you the box is misbehaving, so the fix is preventive. Confirm the device is genuinely Play Protect certified (the off-brand boxes in this operation ship uncertified Android builds), prefer name-brand hardware from Roku, Amazon, Apple, or Google bought from the maker, and if a box looks suspect, retire it. The FBI advised in June 2025 that owners assess connected devices, disconnect suspicious ones, and treat generic streaming boxes sold on free-content promises as suspect.

For anyone buying programmatic advertising, the new attribution detail sharpens what to hunt for:

Scrutinize Taboola-tagged, machine-generated content in your supply path. Bitsight’s beneficiary domains were auto-written finance, health, education, gaming, music, and food blogs whose apparent only function was to host ads for the fleet to click.
Test for the conditional-render tell. Fuyao’s sites served ads only to devices matching a specific spoofed mobile fingerprint. Verification partners can check whether a page renders ads to ordinary visitors or only to a narrow fingerprint band.
Cross-reference sellers.json and beneficiary geography. The payout traced to Hong Kong and Singapore entities via public sellers.json data — a reminder to audit who ultimately collects on inventory you buy, not just the domain serving it.
Score the residential-phone anomaly. A “name-brand phone” that reliably clicks from a residential IP at hours when a household TV is off is a behavioral pattern human traffic does not have.

My Read

The reported facts above come from Bitsight, THN, and public patent records; what follows is my assessment. The meaningful shift this week is from behavior to attribution. A botnet is a whack-a-mole problem; a company with patents, a Blockly-based development pipeline, a 144-domain publishing network, and named collecting entities is a structure — and structures are both more durable and, in principle, more accountable. That is the argument for naming Fuyao at all: it converts a diffuse nuisance into something advertisers, ad exchanges, and regulators can point at.

But attribution is not enforcement, and several things remain open. Bitsight did not establish a complete affected-model list — H96_MAX_V11 was the most identifiable, echoing the H96 brand from our prior coverage — and, importantly, no one has established who installed the apps or at what point in the supply chain they appeared. There is no confirmation that Google Play Protect flags the specific builds, no complete list of malicious packages or network indicators, and, as of THN’s check, Bitsight’s promised technical follow-up had not yet published. I would also situate this in the beat we have tracked all year: from a smart-TV SDK turning televisions into scraping exit nodes, to LG banning proxy apps from its store, to the FBI and Google dismantling the NetNut proxy platform. Fuyao is the same consumer-hardware exposure, now with a corporate face — and the open question is whether a name is enough to make anyone in the ad-tech chain actually stop paying it.