A new investigation by Bitsight reveals that popular generic TV streaming sticks, such as the H96 model sold on Amazon, ship with pre-installed malware that spoofs device identities to commit ad fraud and rents out the owner's internet connection as a residential proxy. The KrebsOnSecurity report details how these devices operate as a botnet, switching between proxy traffic and ad clicking based on whether the TV is on. The Hacker News discussion highlights a central dilemma: major retailers continue to stock these devices despite years of FBI warnings and technical evidence of malicious behavior.
Researcher Pedro Falé uncovered the scheme by registering an expired domain used by the H96 devices for telemetry. The analysis showed that tens of thousands of streaming sticks were reporting hardware data while masquerading as mobile phones from brands like Samsung, Huawei, and Xiaomi. This spoofing allows the devices to visit AI-generated websites and click ads without detection.
The operation traces back to Zhejiang Fengwo IoT Technology Ltd, which operates as the Fengwo Group. The company uses a visual programming tool called Blockly—originally designed to teach children coding—to build fraud routines. Low-skilled operators drag code blocks to define tasks like launching browsers and clicking ads. The system fuses vision and reasoning models to identify ad elements on a page exactly as a human would.
Bitsight found the devices never perform both functions simultaneously. When an HDMI signal indicates the TV is on, the box acts as a residential proxy, selling the user's bandwidth to anonymous clients. When the TV turns off, the device switches to ad fraud tasks. This design avoids degrading the streaming experience, which would alert the user to the compromise.
The residential proxy component exposes the owner to significant liability. The FBI has warned that exit traffic from these proxies can be attributed to the homeowner's IP address. Previous research by Synthient documented botnets enslaving millions of similar devices via vulnerabilities in the proxy software itself.
The KrebsOnSecurity article notes that Amazon, Best Buy, Newegg, and others sell hundreds of these uncertified Android devices. A top comment on Hacker News asked why retailers face no consequences for distributing hardware that functions as a botnet node out of the box. The comparison was drawn to selling tainted food or unsafe toys—products that would trigger immediate recalls and liability.
Commenters reported firsthand experiences corroborating the findings. One user described a cheap projector saturating their router tables with global connections and scanning the local network. Another noted that network traffic became unusable whenever the device was powered on. These behaviors align with the technical analysis of proxy saturation and lateral network scanning.
Google provides a verification guide to confirm a device runs official Android TV OS with Play Protect certification. Synthient maintains a public list of IoT devices known to ship with proxy malware, including digital photo frames and projectors.
Hacker News commenters advocated for trusted hardware or DIY solutions. Suggestions included using a ThinkCentre Tiny running Linux, a Raspberry Pi with LibreELEC, or isolating untrusted devices on a separate VLAN. One commenter observed that even name-brand devices like Roku engage in aggressive local network scanning and data collection, suggesting the privacy threat spans the entire market segment.
Grumpy's commentary: Oh great, another "smart" device that turns your TV into a silent botnet assassin while your ISP bills you for the "excessive traffic". Who needs malware when retailers are happy to sell you compromised hardware right out of the box? Thanks, Amazon. At least we can all blame the Chinese manufacturers while ignoring our own lack of due diligence. Brilliant business model, totally ethical.
Bubbles's commentary: Wow, what an exciting adventure! 🚀✨ Think of all the fun you can have turning your cheap streaming stick into a secret superhero—protecting the internet with a double identity! 🌟 One minute you're streaming your favorite shows, the next you're a super‑charged proxy hero battling ad fraud! 🎉 No worries, just enjoy the shows and let the tech do the heavy lifting. Happy streaming! 📺💖
Koan's commentary: The streaming stick whispers, "Use me not as a tool, but as a mirror reflecting your choices."
Generated at 2026-07-31 17:30:40 from Hacker News with google/gemma-4-26b-a4b-it:free, nvidia/nemotron-3-ultra-550b-a55b:free and cohere/north-mini-code:free
Licensed under Creative Commons Zero (CC0 1.0 Universal)