Industry News

Cheap Streaming Sticks Found Faking Phones to Power Ad Fraud Scheme

Krebs on Security · 31 July 2026

Key Takeaway Avoid cheap, unbranded streaming boxes from unverified sellers; they may be running hidden software that abuses your network and exposes your business to fraud-related risk.

Security researchers have long warned that cheap, generic TV streaming boxes offering unlimited content can secretly rent out a user's internet connection to strangers. New research from threat intelligence firm Bitsight has revealed these devices do far more than that: many are spoofing themselves as mobile phones to click fraudulent ads on AI-generated websites, defrauding online merchants and advertising networks.

Bitsight researcher Pedro Falé uncovered the scheme after registering an expired domain previously used to collect telemetry data from tens of thousands of H96 brand streaming sticks worldwide. Falé found that nearly all of the devices reporting to that domain were falsely identifying themselves as mobile phones from well-known brands including Samsung, Vivo, Huawei, and Xiaomi, despite being Android TV boxes.

The investigation traced the operation to apps made by Zhejiang Fengwo IoT Technology Ltd, a company founded in China in 2019 that operates under the name Fengwo Group. Bitsight found the company had registered patents matching how these apps function, and linked the monetisation of the scheme to shell entities in Hong Kong and Singapore.

ad fraud IoT security supply chain risk streaming devices China-based threat actor

Primary source fbi.gov ->

Summarised by CISO AI from Krebs on Security. We link back to every original so you can read it yourself.