安全研究人员发现，H96等廉价电视流媒体盒存在严重安全隐患。[1]这些设备不仅预装了将用户网络出租给第三方的代理软件，还被秘密用于大规模广告欺诈操作。[1]Bitsight公司研究员Pedro Falé追踪发现，幕后操纵方是中国公司Zhejiang Fengwo IoT Technology Ltd，该欺诈网络日均收入约5万美元。[1]
根据调查，约38,000台电视盒向过期域名回传数据。[1]这些设备伪装成三星、Vivo、华为、小米等品牌的智能手机，通过AI生成的网站点击虚假广告来欺骗在线商户和广告网络。[1]设备根据使用状态灵活切换功能——当检测到HDMI信号时用作代理，电视关闭时则参与广告欺诈操作。[1]
Fengwo Group声称拥有超过120,000个"AI数字人"。[1]令人担忧的是，Amazon、Best Buy、Newegg等主流电商平台仍在继续销售这类设备。[1]
Security researchers at Bitsight have identified a widespread fraud operation involving inexpensive TV streaming boxes, such as the H96 model, that are preloaded with malicious software [1]. These devices come equipped with proxy software that rents users' network connections to third parties and participate in large-scale ad fraud schemes [1]. Researcher Pedro Falé traced the operation back to Chinese company Zhejiang Fengwo IoT Technology Ltd, with the fraudulent network generating approximately $50,000 in daily revenue [1].
The scheme operates through a deceptive dual-purpose mechanism: when an HDMI signal is detected, the devices function as proxies for renting bandwidth, and when the television is powered off, they participate in ad fraud by impersonating mobile phones from major manufacturers including Samsung, Vivo, Huawei, and Xiaomi [1]. The devices are disguised as mobile phones through AI-generated website clicks to commit ad fraud against online merchants and advertising networks [1]. Falé noted that "multiple devices reporting to this factory Android TV Box backdoor were 'phones'" [1]. The researchers tracked approximately 38,000 TV boxes transmitting data to expired domains as part of this operation [1]. Fengwo Group, the parent organization, claims to operate over 120,000 "AI digital persons" [1]. Despite these findings, such devices continue to be sold on major retail platforms including Amazon, Best Buy, and Newegg [1].