Security experts have long warned about generic TV boxes that secretly rent out users' internet connections. A new analysis reveals these devices also spoof themselves as mobile phones to click on ads on AI-generated websites, defrauding merchants and ad networks. Researcher Pedro Falé discovered this by registering an expired domain used by a popular streaming device brand, H96. The domain previously collected hardware and app data from thousands of H96 sticks globally.

Falé found that these devices falsely reported being mobile phones from manufacturers like Samsung and Huawei. They transmitted data related to two apps from Zhejiang Fengwo IoT Technology Ltd, operating as Fengwo Group. This group holds patents matching the apps' functionality. The apps coordinate an ad fraud network using H96 devices as traffic sources to click ads on Fengwo Group's AI-generated websites. These sites feature machine-generated content but only display ads when visited by devices matching the spoofed mobile profiles.

Fengwo Group's domain promotes "AI digital humans" for rent. The company uses a Google-built visual programming language called Blockly to build its sham websites, enabling low-skilled operators to create fraud routines easily. The H96 devices are programmed to perform tasks like silently launching browsers and clicking ads. Bitsight estimates this ad fraud network generates nearly $50,000 a day, with conservative estimates based on data from only one older domain. The devices switch between acting as residential proxies when the TV is on and engaging in ad fraud when it's off.