The Cheap TV Stick That’s Actually a Click-Farming Bot
You see them on Amazon for $30 or $40. They promise free movies, live sports, and endless channels — no subscription needed. They’re called H96 streaming sticks, and they look like a bargain. But a new investigation from security firm Bitsight TRACE reveals these devices aren’t just a privacy risk. They’re part of a sophisticated ad fraud network that turns your living room into a cash machine — for someone else.
Researcher Pedro Falé bought an expired domain once used by thousands of H96 boxes for telemetry. What he found inside was a sprawling operation. The devices weren’t just streaming Netflix. They were masquerading as Samsung, Vivo, Huawei, and Xiaomi smartphones, clicking ads on AI-generated websites. “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones,’” Falé said. “Something was wildly wrong.”
This is the story of how a cheap TV streaming stick ad fraud network works — and why you should think twice before plugging one in.
How H96 Devices Fake Being Phones
Bitsight TRACE tracked roughly 38,000 H96 boxes worldwide phoning home to that expired domain. Each device reported its hardware specs and a full list of installed apps. But the data showed something odd: every box claimed to be a mobile phone model from a major manufacturer. The same two apps were installed on all of them, both made by a Chinese company called Zhejiang Fengwo IoT Technology Ltd, operating under the Fengwo Group.
Falé dug deeper. He found that Fengwo Group had registered patents matching the apps’ behavior. The apps coordinate a network where H96 devices serve as “captive traffic sources.” They visit websites — also run by Fengwo — that only display ads when the visitor matches a spoofed mobile profile. The boxes click those ads, generating revenue from advertisers who think they’re reaching real people on phones.
The websites themselves are bizarre. Bitsight found machine-generated news articles on finance, health, education, gaming, and food blogs. No human wrote them. AI did. And the sites only show ads to the spoofed devices. To a normal browser, they appear ad-free.
Blockly: The Drag-and-Drop Malware Factory
Fengwo Group’s homepage claims it has created more than 120,000 “AI digital humans” for rent — for companionship, customer service, or creative design. Bitsight’s report suggests this might be a cover story. But the real ingenuity lies in how the fraud is built.
The group uses a Google-built visual programming language called Blockly, originally designed to teach kids to code. Fengwo’s employees drag and drop code blocks in a Blockly editor to define fraud routines. “An operator doesn’t need as much understanding of the underlying technicalities,” Bitsight’s report notes. “Only a small number of highly-skilled developers are needed to build the template execution-unit images.”
When an H96 box is selected for a task, it receives the appropriate Blockly module. That module can silently launch a browser, visit pages, manage tabs, and click ads. The system fuses three vision and reasoning systems into one interface, letting bots identify ads on a page and navigate like a human. It’s ad fraud made easy — no coding skills required.
When Your TV Is On, Your Internet Is for Rent
Bitsight discovered a chilling pattern. When the H96 box detects an HDMI signal — meaning you’re watching something — it switches to residential proxy mode. That means it rents your home’s IP address to strangers: content scrapers, ticket scalpers, even cybercriminals. When the TV is off, the box flips back to ad fraud mode, waiting for its next click job.
Falé believes the device is designed this way because ad fraud tasks are resource-heavy and would interfere with streaming video. So the box only runs fraud when you’re not using it. But the proxy software runs whenever the TV is on. Either way, your network is being used without your knowledge.
These devices are also notoriously insecure. They ship with no authentication, default passwords, and outdated Android builds. In January, the proxy tracking service Synthient documented how botnets enslaved millions of TV boxes by exploiting vulnerabilities in both the proxy software and the hardware itself. Plug one in, and you’re inviting attackers onto your network.
The $50,000-a-Day Business Model
Bitsight estimates the Fengwo Group’s ad fraud network generates close to $50,000 per day — and that’s from just one old domain. The actual revenue, including the residential proxy side, could be much higher. “These estimates are highly conservative,” Falé said.
Despite repeated warnings from the FBI and security firms, major e-commerce platforms like Amazon, Best Buy, and Newegg continue to sell hundreds of models that bundle unofficial Android versions. They’re marketed by influencers as a way to stream premium content for free. But the real cost is your privacy, your network security, and your bandwidth.
Fengwo Group did not respond to requests for comment. Emails to its contact address bounced back with a message that the inbox was full — or “getting too much mail right now.”
How to Protect Yourself
The safest move is simple: stick to name-brand streaming devices from reputable manufacturers. Google provides a way to check if a device is certified for Android TV OS and Play Protect. Synthient also maintains a list of IoT devices known to ship with pre-installed proxy software and malicious apps. That list includes not just streaming sticks but also digital photo frames — another popular category the FBI has flagged.
Even with a trusted device, be careful what apps you install. Many third-party apps bundle residential proxy software. If a deal sounds too good to be true — a $30 stick that unlocks all the world’s TV — it almost certainly is. The real price is your home network, turned into a tool for fraud.
