Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

A Chinese company, Zhejiang Fengwo IoT Technology Co., Ltd., is behind the ‘Fuyao’ operation, which involves shipping cheap Android TV boxes with apps that mimic phones and then use them to relay internet traffic as SOCKS5 exit nodes for ad fraud. Bitsight discovered the operation by identifying a factory backdoor and tracking over 38,000 unique devices. The operation leverages a complex system of automation, machine vision, and JavaScript-based fraud routines, generating an estimated $40 million in annual revenue. Despite the scale of the operation, a complete list of affected devices and network indicators remains elusive.