If you bought a cheap Android TV streaming stick — the kind sold on Amazon for under $30 that promises free movies and live TV — there’s a good chance it’s been quietly recruited into an ad fraud ring. Researchers at Bitsight discovered that H96-brand streaming boxes, which are widely sold on Amazon and other retailers, come with factory-installed apps that secretly disguise the device as a Samsung, Vivo, Huawei, or Xiaomi smartphone. Once spoofed, the boxes browse to AI-generated websites controlled by a Chinese company called Zhejiang Fengwo IoT Technology Ltd and click on ads there — ads that only display when the visiting “device” matches the spoofed mobile profile. The owners of those H96 boxes never see any of this happening. From the outside, the device appears to be doing nothing; in the background it’s farming fake ad impressions and funneling the revenue to the Fengwo Group.
Bitsight researcher Pedro Falé got inside the operation by registering an expired domain that the H96 boxes were using as a telemetry endpoint. Within days, data from tens of thousands of boxes worldwide began flooding in, revealing the full scope of the network. The operation’s infrastructure was traced back to Zhejiang Fengwo IoT, which holds patents describing exactly the mechanism Bitsight found on the devices. The Fengwo Group also operates a fleet of more than 120,000 self-described “AI digital humans” for rent, as well as a drag-and-drop Blockly-based tool that lets low-skill operators build and deploy the fake ad-clicking websites without writing any code. The same SSL certificate data appears across the Fengwo Group’s domain and the spoofing apps pre-installed on H96 devices.
How to check if you’re affected
Affected devices are any H96-branded Android TV streaming sticks currently connected to your home network. These are often sold under product names like “H96 Max,” “H96 Pro,” or “H96 Mini” on Amazon, AliExpress, and similar discount electronics marketplaces. Check the label on the back of your device or the Amazon listing from which you bought it for the “H96” brand name. If you have one, Bitsight recommends disconnecting it from your network and replacing it with a device from a mainstream manufacturer such as Amazon Fire TV, Google Chromecast, Roku, or Apple TV.