Cheap Android TV Boxes Pose as Phones and Turn Owners' Broadband Into Proxies
Researchers at Bitsight have uncovered 'Fuyao,' a Chinese operation that ships cheap Android TV boxes preloaded with apps that spoof phone identities, click ads, and relay traffic as SOCKS5 proxies.
Intelligence analysis by Llama
Bitsight researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology, a mainland China company founded in 2019. The boxes mimic Samsung, Huawei, Xiaomi, or Vivo phones, click ads via ML-driven automation, and act as proxy exit nodes when an HDMI signal is absent.
Some cheap TV boxes come with sneaky apps already inside that pretend to be a phone. They secretly watch ads and click them for money, and they also let strangers route internet traffic through the buyer's home Wi-Fi — like a stranger borrowing your house as a hideout.
Analysis
A factory-fresh dual purpose
Fuyao's defining trick is that the offending apps do two unrelated jobs in one box. When the device is connected to a TV and receiving an HDMI signal, it idles; once HDMI is removed, it switches into a SOCKS5 exit node, handing a stranger's traffic through the owner's home broadband. Bitsight sinkhole data showed roughly 38,000 unique MAC addresses reporting in a single filtered day, with most spoofing phone identities rather than admitting they are TV boxes. That makes fingerprinting the fleet harder for defenders and lets the operators blend residential traffic into the background noise of normal phone users.
Vision models doing the ad clicking
The ad-fraud side is unusually engineered for cheap hardware. Bitsight recovered a YOLOv8s object-detection model named lourui_2, trained on twelve screen elements including generic banner regions and Taboola widgets, paired with Android accessibility data and Google ML Kit OCR. According to Pedro Falé of Bitsight, the operation "fuses three vision and reasoning systems into a single interface." Campaign logic is assembled in a Blockly-based editor, exported as JavaScript, dumped to S3, and pushed to the box for execution. Across four test devices Bitsight captured about 40 fraud tasks, 21 campaigns, and 166 modules — the template architecture a developer comment described as a way for skilled engineers to scaffold work for cheaper operators.
Attribution, money trail, and what is still missing
Bitsight tied the operation to Zhejiang Fengwo IoT Technology through shared TLS certificates, exposed wiki pages, reused emails, revenue links, and patents. Public Chinese patent records independently list Zhejiang Fengwo as assignee on CN117421142B (digital-human execution tracking) and CN117478834A (remote screen monitoring via cloud thumbnails), though neither describes ad fraud. Bitsight modelled gross returns around $1.25 per device per day — roughly $47,500 daily across the 38,000-device sinkhole sample — and floated up to $40 million annually at the advertised fleet size of more than 120,000 "AI digital humans," a marketing term the report does not unpick. At the time of writing, the technical follow-up, full affected-package list, firmware builds, and network indicators had not yet appeared, so identification guidance for buyers still defaults to checking Play Protect certification and disconnecting suspect boxes, per the FBI's June 2025 advisory.
Key points
- Bitsight attributes the operation, named Fuyao, to mainland China–based Zhejiang Fengwo IoT Technology Co., Ltd., founded in 2019.
- Compromised boxes spoof phone identities from Samsung, Huawei, Xiaomi, or Vivo and can act as SOCKS5 proxy exit nodes when not in HDMI use.
- Ad-fraud automation uses a YOLOv8s model called `lourui_2`, Android accessibility hooks, and ML Kit OCR, with campaign logic authored in a Blockly-based editor.
- Bitsight's sinkhole saw ~38,000 unique MAC addresses reporting in a single filtered day; gross-return estimates top out near $40M/year at the advertised fleet size.
- A full list of affected packages, firmware builds, and network indicators was not yet published at the time of the report.
Bitsight's sinkholing of an expired factory backdoor domain is already disrupting telemetry and command delivery for affected boxes, and the public attribution gives defenders and advertisers concrete domains, certificate fingerprints, and patent ties to hunt on. Greater transparency around Play Protect certification and firmware provenance could push responsible retailers and OEMs to demand auditable supply chains for commodity streamers.
The operation's economics — under fifty cents per device per day in nominal proxy or ad revenue, at scale — mean it can absorb takedowns and rotate identifiers as cheaply as it ships new boxes, and Bitsight still lacks a confirmed list of affected packages, firmware builds, or network indicators. Because the compromise appears to ship from the factory, ordinary buyers have no realistic way to detect a poisoned unit without outside help, leaving millions of home networks quietly leased out as residential proxies and ad-clicking bots.
