Bitsight Links Fuyao Android TV Boxes to Ad Fraud and SOCKS5 Proxying
Summary
Bitsight says Fuyao apps on some cheap Android TV boxes spoof phone identities for ad fraud and can relay traffic as SOCKS5 exit nodes. Its findings link the operation to Zhejiang Fengwo, but affected devices and the company's role remain incompletely established.
Key points
- Bitsight says some Android TV boxes carry Fuyao apps that spoof Samsung, Huawei, Xiaomi, or Vivo phone identities and click ads.
- The apps reportedly switch to relaying traffic through owners' broadband as SOCKS5 exit nodes when an HDMI signal is detected.
- Bitsight found the operation by registering an expired domain used as a factory backdoor and telemetry collector; many identifiable devices reported the model H96_MAX_V11.
- The ad-fraud workflow combines a YOLOv8s model, Android accessibility data, OCR, and a Blockly-based editor that exports JavaScript routines.
- Across four test devices, Bitsight captured about 40 fraud tasks, 21 campaigns, and 166 modules; it also mapped 144 operator-owned domains, at least 84 of which loaded a Taboola tag.
- A sinkhole received 65,957 reports from about 38,000 MAC addresses in one day, but identifier rotation means these figures do not establish the physical device count.
- Bitsight attributed Fuyao to Zhejiang Fengwo using several links, but the evidence does not establish the company's role; affected packages, firmware, and network indicators remain incomplete.
Article Details
- Attack Vectors
- Bitsight reported that some cheap Android TV boxes shipped with apps that spoof phone identities, including Samsung, Huawei, Xiaomi, and Vivo models, and click ads on operator-run websites.
- When an HDMI signal is detected, the apps can relay third-party traffic through the device owner's broadband connection as SOCKS5 exit nodes.
- A C2 server sends phone profiles to devices; profiles combine a base configuration with a model-specific diff and remove chipset properties that could reveal the underlying board.
- The fraud workflow uses YOLOv8s, Android accessibility data, and Google ML Kit OCR to locate ads. Operators create routines in a Blockly-based editor, export them as JavaScript, upload them to S3, and send them to devices for execution.
- Defensive Notes
- Verify that devices are Play Protect certified and disconnect suspicious devices from the network.
- Keep device firmware current and treat generic streaming boxes sold with promises of free content as suspect, consistent with FBI guidance cited in the article.
- Fuyao-specific identification guidance remains incomplete; the article says the affected packages, firmware builds, and network indicators were not fully documented.
MITRE ATT&CK
T1036 · MasqueradingFuyao apps alter device identity and phone profiles so Android TV boxes appear to be phones, including Samsung, Huawei, Xiaomi, or Vivo models.T1059.007 · JavaScriptFraud routines are exported as JavaScript and sent to the boxes for execution.T1090 · ProxyThe boxes relay other people's traffic through owners' broadband connections as SOCKS5 exit nodes.T1105 · Ingress Tool TransferOperators send JavaScript fraud routines to the boxes for execution after uploading them to S3.T1496.002 · Bandwidth HijackingThe operation uses device owners' broadband bandwidth to relay third-party traffic through SOCKS5 exit nodes.
People
Vendors
Products
AndroidBitsight uncovered Fuyao, an operation tied to Zhejiang Fengwo IoT Technology Co., Ltd., in which cheap Android TV boxes spoof phone identities and click ads while also relaying traffic as SOCKS5 exit nodes.H96_MAX_V11#FuyaoPlay ProtectOwners are advised to verify Play Protect certification and disconnect suspicious devices.
Tools
BlocklyThe campaign uses a custom automation stack with YOLOv8s, Blockly, and ad-network infrastructure to drive fraud, but the full list of affected devices and packages remains incomplete.Google ML KitThe app combines the model with Android accessibility data and Google ML Kit optical character recognition.YOLOv8sThe campaign uses a custom automation stack with YOLOv8s, Blockly, and ad-network infrastructure to drive fraud, but the full list of affected devices and packages remains incomplete.
Countries
ChinaResearchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company founded in 2019.Hong KongThe researchers said they used Taboola’s public sellers.json file to connect the domains to revenue-collecting entities in Hong Kong and Singapore.SingaporeThe researchers said they used Taboola’s public sellers.json file to connect the domains to revenue-collecting entities in Hong Kong and Singapore.