H96 Streaming Devices and the Fengwo Group Ad Fraud Network

H96 Streaming Sticks Used for Large-Scale Ad Fraud

Generic TV streaming devices, specifically the H96 brand, are being used as part of a sprawling ad fraud operation that spoofs the devices as mobile phones to click ads on AI-generated websites. This operation, orchestrated by the Fengwo Group (Zhejiang Fengwo IoT Technology Ltd), defrauds online merchants and advertising networks by generating fake traffic from residential IP addresses.

Threat researcher Pedro Falé of Bitsight discovered the network after registering an expired domain used for telemetry. He found that tens of thousands of H96 devices were transmitting data while claiming to be mobile phones from manufacturers such as Samsung, Vivo, Huawei, and Xiaomi, despite being Android TV boxes.

The Fengwo Group's Fraud Infrastructure

The Fengwo Group utilizes a sophisticated pipeline to maintain its ad fraud empire, combining AI-generated content with low-code automation:

AI-Generated Content and Spoofing

Bitsight identified that the Fengwo Group operates websites containing machine-generated news articles and graphics across categories like finance, health, and gaming. These sites only display ads when the visiting device matches the spoofed mobile profile of an H96 device, ensuring the fraud remains targeted and undetected by standard traffic filters.

Low-Code Automation via Blockly

To scale the operation, the group uses a proprietary implementation of Blockly, a Google-built visual programming language. This allows low-skilled operators to build fraud routines by dragging and dropping code blocks without needing deep technical knowledge. These routines are then exported as JavaScript and pushed to the H96 devices to execute tasks such as:

  • Silently launching web browsers
  • Visiting specific websites
  • Managing tabs
  • Clicking on ads

Vision and Reasoning Systems

To mimic human behavior and successfully navigate AI-generated pages, the group fuses three vision and reasoning systems into a single interface. This allows the bots to correctly identify ad placements and interact with them as a human user would.

Dual-Purpose Malware: Residential Proxies and Ad Fraud

Bitsight found that H96 devices typically perform one of two malicious functions depending on the device's state, but never both simultaneously:

  1. Residential Proxy: When the device detects an HDMI signal (indicating the user is watching TV), it functions as a residential proxy, renting the user's internet connection to third parties, including scrapers and cybercriminals.
  2. Ad Fraud: When the TV is off, the device switches to executing ad fraud jobs, which are more resource-intensive and would otherwise interfere with the user's streaming experience.

Broader Security Implications for IoT

This case highlights a systemic risk associated with "too good to be true" streaming devices that promise unlimited content for a one-time fee. These devices often ship with unofficial versions of Android and lack basic authentication, making them easy targets for botnets.

Industry and Community Insights

Discussion among security professionals and users emphasizes that this is not an isolated incident. Community reports suggest similar behavior in other cheap IoT devices, such as Android-based projectors.

"In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory."

Experts recommend several mitigation strategies for users of IoT devices:

  • Network Isolation: Use a dedicated guest WiFi network or VLANs to isolate potentially hostile IoT devices from trusted computers.
  • Hardware Verification: Use devices with official Android TV OS and Play Protect certification.
  • Alternative Hardware: Consider using reputable name-brand hardware or open-source alternatives like Raspberry Pi running LibreELEC for local media playback.

Retailer Responsibility

There is significant concern regarding the role of major e-commerce platforms like Amazon, Best Buy, and Newegg, which continue to sell these devices despite warnings from the FBI and security researchers about the inherent risks of pre-installed residential proxy software.

Sources