**The Fuyao Fraud Operation: When Android TV Boxes Turn into Ad-Fraud Machines**
A recent report by cybersecurity firm Bitsight has uncovered a sophisticated ad-fraud scheme targeting the Internet of Things (IoT) landscape. The operation, codenamed **Fuyao**, involves cheap Android TV boxes that are pre-loaded with malicious software designed to spoof their hardware identity and generate fraudulent advertising revenue.
**How the Spoofing and Fraud Works**
According to the report, the devices, primarily identified by the model name **H96_MAX_V11**, are manufactured with apps that can rewrite their hardware identity. Instead of revealing their true, generic chipset roots (often Rockchip, Amlogic, or Allwinner), the software alters the device information to mimic legitimate, premium brands such as Samsung, Huawei, Xiaomi, or Vivo.
This identity spoofing serves two primary purposes:
1. **Ad Fraud:** The apps simulate clicks on advertisements hosted on websites operated by the same malicious actors, generating illegitimate ad revenue.
2. **SOCKS5 Exit Node Hijacking:** When the device detects an HDMI signal (indicating it is actively being used), it switches roles. It begins routing other people’s internet traffic through the owner’s broadband connection, effectively turning the box into a proxy server or exit node. When the HDMI signal is off, the device reverts to its ad-fraud waiting mode.
**Attribution and Scale**
Bitsight attributed the operation to **Zhejiang Fengwo IoT Technology Co., Ltd.**, a Chinese company founded in 2019. The discovery was made after researchers registered an expired domain used as a factory backdoor. In a single day, the sinkhole server received over 65,000 reports from approximately 38,000 unique devices.
The financial scale of the operation is significant. Bitsight estimated that the network of 38,000 active devices could generate approximately **$47,500 per day** in gross returns. They further project potential annual revenue could reach **$40 million**, assuming a 30-40% fraud flagging rate and a 70% ad-fill rate.
**The Technical Sophistication**
The Fuyao operation is notable for its technical complexity. It utilizes machine vision within the device’s automation workflow to locate and click on ads accurately. The system integrates a YOLOv8s object-detection model with Android accessibility services and Google ML Kit OCR to identify and interact with specific screen elements.
Command-and-control (C2) servers push complete fake user profiles to each device, blending a base configuration with model-specific adjustments to hide the underlying hardware. The operation is managed through a custom editor built on Blockly (Google’s visual programming editor), where fraud routines are coded in JavaScript, uploaded to cloud storage (S3), and then executed on the compromised boxes.
—
### FAQ
**Q: What is the “Fuyao” operation?**
A: Fuyao is the name given by cybersecurity firm Bitsight to a large-scale ad-fraud operation. It involves malicious apps running on cheap, off-brand Android TV boxes that spoof their device identity to mimic popular brands like Samsung and Huawei. The primary goals are to generate fraudulent ad clicks and, secondarily, to hijack the device’s internet connection to act as a proxy (SOCKS5 exit node) for other traffic.
**Q: Which devices are affected?**
A: The devices are cheap Android TV boxes, often identified by the model name **H96_MAX_V11**. However, the operation likely affects other models, as the reporting from the sinkhole server was skewed toward older versions of one brand.
**Q: How do the devices spoof their identity?**
A: The pre-installed malicious apps can rewrite the device’s reported hardware identity. They replace the true chipset information (e.g., Rockchip, Amlogic) with fake data that makes the device appear to be a premium-brand phone or TV, such as a Samsung or Xiaomi device.
**Q: What are the secondary malicious activities?**
A: When an HDMI signal is detected (meaning the box is in use), the apps deactivate ad fraud and activate a proxy function. The device then uses the owner’s broadband connection to relay traffic for other users as a SOCKS5 proxy. When the HDMI is off, the apps resume their ad-fraud activities.
**Q: How does the Fuyao operation make money?**
A: The operation generates revenue by simulating ad clicks on websites controlled by the attackers. They use a complex infrastructure, including a custom command-and-control system and machine-vision technology, to automate the process at scale. The revenue is estimated to be in the millions of dollars annually.
**Q: What should I do if I own an Android TV box?**
A: The FBI and Bitsight advise users to be cautious with generic streaming boxes sold at deep discounts. Users should ensure their device’s firmware is up to date. Most importantly, users should verify that their Android device is **Play Protect certified**, which ensures it has passed Google’s security and compatibility tests. A list of certified devices can be found on Google’s Android TV website.
—
### Conclusion
The Fuyao operation represents a significant evolution in IoT-based cybercrime. It moves beyond simple botnets by leveraging sophisticated identity spoofing and machine vision to integrate seamlessly into the digital advertising ecosystem. By turning compromised hardware into both fake users and proxy servers, the attackers have created a multi-purpose fraud machine. This case highlights the security risks associated with low-cost, off-brand connected devices and serves as a warning for consumers to prioritize security and certification over price.
