Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators.
Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company founded in 2019.
The same apps have a second job. When a box detects an HDMI signal, it usually switches to relaying other people’s traffic through the owner’s broadband line as a SOCKS5 exit node. With HDMI off, it goes back to waiting for ad-fraud tasks.
Bitsight found the operation by registering an expired domain used as a factory backdoor and telemetry collector. Most identifiable devices reported the model name H96_MAX_V11, though Bitsight said its sinkhole view was skewed toward older models from one brand and did not establish a complete affected-model list.
In one day, after filtering for devices carrying the Fuyao apps, the sinkhole received 65,957 reports from about 38,000 unique MAC addresses. Most reports described the devices as phones. That is not a confirmed device count because the system can rotate spoofed identifiers.
The report separately shows Fengwo advertising more than 120,000 “AI digital humans,” but does not establish what that marketing term counts. These figures are not interchangeable, and none establishes the physical fleet size. For owners, guidance remains generic: verify Play Protect certification and disconnect suspicious devices from the network.
The command-and-control (C2) server pushes complete phone profiles to each device, merging a base configuration with a per-model diff and deleting chipset properties that would expose a Rockchip, Amlogic, or Allwinner board underneath.
Fuyao uses machine vision inside its automation workflow to locate ads. The Script app carries a YOLOv8s object-detection model named lourui_2, trained on 12 screen elements, including generic banner regions and Taboola widgets. The app combines the model with Android accessibility data and Google ML Kit optical character recognition.
Pedro Falé, a Bitsight threat researcher, wrote that the operation “fuses three vision and reasoning systems into a single interface.”
Operators assemble campaign logic in a custom editor built on Blockly, Google’s drag-and-drop programming framework. They export each fraud routine as JavaScript, upload it to S3, and send it to the box for execution.
Across four test devices, Bitsight captured about 40 fraud tasks, 21 unique campaigns, and 166 unique modules. A recovered developer comment said the template system let a small group of skilled engineers support less-skilled campaign operators, cutting costs.
Fuyao’s payout chain runs through a publishing network. Bitsight mapped 144 operator-owned domains across seven beneficiary clusters. At least 84 of them loaded a Taboola tag on the homepage. The researchers said they used Taboola’s public sellers.json file to connect the domains to revenue-collecting entities in Hong Kong and Singapore. Bitsight modeled gross returns at $1.25 per device per day, or about $47,500 daily if 38,000 devices were active.
It separately estimated annual revenue could reach $40 million at the advertised fleet size, citing 30-40% fraud flagging and a 70% ad-fill rate, but did not show the full calculation. Those are estimates, not observed revenue.
Attribution to Fengwo rests on Bitsight, which cited shared TLS certificate data, exposed wiki files, reused email addresses, revenue links, and patents.
Public Chinese patent records independently identify Zhejiang Fengwo as the assignee of related digital-human execution and monitoring technologies. CN117421142B, granted in November 2024, covers execution-flow tracking for digital-human behavior modules, while CN117478834A describes monitoring remote screens through cloud-hosted thumbnails and keyframe comparison. Neither filing describes advertising, and the records do not establish that the company operated Fuyao or engaged in ad fraud.
The sources checked also do not establish who installed the apps or at what point in the device supply chain they appeared.
As of 7:48 p.m. IST on July 31, 2026, Bitsight’s blog index still listed only the July 30 overview for Fuyao, and The Hacker News could not find either promised technical follow-up in exact-title site searches. The material checked still lacked a complete list of affected packages, firmware builds, and network indicators. Fuyao-specific identification guidance therefore remains incomplete.
Google explains how to check whether a device is Play Protect certified. The FBI advised in June 2025 that owners assess connected devices, disconnect suspicious ones, keep firmware current, and treat generic streaming boxes sold on promises of free content as suspect.
