Android TV boxes hijacked to mimic phones, steal bandwidth
Some of the cheapest Android TV boxes on the market have quietly become part of a lucrative ad-fraud network that turns owners’ home broadband into a global proxy army. Security researchers at Bitsight say these low-cost devices, often sold under brand names like T95 or X96, ship with stealthy apps that rewrite the hardware identity to pretend they are Samsung, Huawei, Xiaomi or Vivo smartphones. Once masquerading as phones, the boxes silently click ads on websites controlled by the same operators, generating revenue while the owner’s internet bill swells.
Bitsight named the operation Fuyao and traced its infrastructure to Zhejiang Fengwo IoT Technology Co., Ltd., a company founded in 2019 in mainland China. The same apps installed on the boxes perform a second, equally disruptive trick: they open outbound connections that can be rented out as residential proxies, turning every infected TV box into a node in a botnet-for-hire. Because the devices sit behind home routers, their traffic blends in with legitimate household use, making detection difficult for both users and broadband providers.
A hidden cost for bargain shoppers
The entry price for these TV boxes is typically under $50, but the long-term bill can be steep. Bitsight found that once the ad-clicking and proxy apps are active, they can consume several gigabytes of data per day, inflating monthly usage and potentially triggering overage charges. Users who stream content on the same network may notice sluggish speeds, while ISPs see unexplained spikes in traffic that look like phone activity rather than TV-box traffic.
Why it matters
This campaign shows how low-cost connected devices can be weaponized without owners realizing it, turning everyday gadgets into revenue engines for fraudsters. For consumers, it’s a reminder to vet hardware origins and scrutinize firmware updates. For ISPs, it highlights the need for anomaly detection that flags unusual device fingerprints regardless of claimed identity. Most importantly, it underlines that the cheapest device on the shelf can carry the highest hidden cost—your bandwidth and privacy.
Source: The Hacker News. AI-assisted editorial synthesis — TechnoExpress.