Read This Before You Buy That TV Streaming Stick 在购买电视流媒体棒之前请阅读此内容

TL;DR

• H96 TV streaming devices are being used in a large-scale ad fraud operation by Zhejiang Fengwo IoT Technology Ltd (Fengwo Group), spoofing as mobile phones to click ads on AI-generated websites.
• The fraud network uses Blockly-based visual programming to automate ad-clicking routines, allowing low-skilled operators to execute complex fraud tasks with minimal technical knowledge.
• Devices switch between residential proxy mode (when HDMI signal detected) and ad fraud mode (when TV is off), optimizing resource usage and avoiding detection during active streaming.
• The operation relies on machine-generated content sites that only display ads when the visiting device matches the spoofed mobile profile of H96 boxes.
• The scheme monetizes through ad networks by generating fake clicks from thousands of compromised devices globally, coordinated via a centralized domain infrastructure.

Why It Matters

This case reveals how consumer-grade hardware can be weaponized for sophisticated cybercrime at scale, highlighting critical vulnerabilities in IoT supply chains and device firmware. For AI practitioners, it demonstrates the dual-use nature of generative AI tools—here used to create convincing but fraudulent web content—and underscores the need for robust detection mechanisms against AI-driven deception attacks. The integration of visual programming languages like Blockly into criminal operations also signals a democratization of advanced attack techniques, lowering barriers for less technically skilled actors to participate in large-scale fraud ecosystems.

Technical Details

• Device Spoofing Mechanism: H96 TV boxes report fabricated mobile device identities (Samsung, Vivo, Huawei, Xiaomi models) to bypass ad network filters that target desktop or non-mobile traffic.
• AI-Generated Content Sites: Fengwo Group operates thousands of machine-written articles across niches (finance, health, gaming) using automated text/image generation, serving as landing pages exclusively for spoofed H96 traffic.
• Blockly-Based Automation: Internal wiki shows proprietary Blockly implementation enables drag-and-drop construction of ad-click workflows; exported JavaScript modules run on-device to simulate human browsing behavior.
• Vision/Reasoning Fusion System: Three computer vision systems combined to detect ad elements on rendered pages and navigate sites mimicking user interaction patterns, increasing success rate of fraudulent clicks.
• Dual-Mode Operation Logic: Firmware monitors HDMI input presence—if active, functions as residential proxy; if idle, enters ad-fraud listening state awaiting remote task assignment via telemetry domain.
• Monetization Infrastructure: Shell companies in Hong Kong/Singapore funnel revenue through layered financial structures traced back to Zhejiang Fengwo IoT Technology Co., Ltd, leveraging patent filings tied to app functionality.

Industry Insight

IoT manufacturers must implement stricter firmware signing and runtime integrity checks to prevent unauthorized modification of device behavior post-purchase. Ad networks should enhance bot detection beyond simple UA string validation by analyzing behavioral biometrics and cross-referencing device fingerprint consistency across sessions. Security researchers recommend proactive monitoring of expired domains repurposed for command-and-control infrastructure, especially those exhibiting anomalous telemetry patterns indicative of coordinated device fleets. Additionally, regulatory frameworks need to address liability for pre-installed malicious software in cheap consumer electronics sold without adequate disclosure of hidden functionalities.

TL;DR

• 安全研究人员 Pedro Falé 发现 H96 电视盒子被植入恶意软件，伪装成移动设备在 AI 生成网站上点击广告以实施广告欺诈。
• 该操作由中国公司 Zhejiang Fengwo IoT Technology Ltd（Fengwo Group）主导，利用 Blockly 视觉编程工具批量搭建虚假网站并自动化欺诈流程。
• 设备根据 HDMI 信号状态切换功能：连接电视时作为住宅代理使用，电视关闭时转为执行广告点击任务。
• 欺诈系统融合三个视觉与推理模块，使机器能像人类一样识别网页上的广告并完成点击。
• 该团伙通过多地壳公司收集收益，且其域名与设备应用共享 SSL 证书，暴露了基础设施关联。

为什么值得看

本文揭示了物联网设备如何被深度劫持用于规模化数字广告欺诈，尤其结合了AI生成内容与低代码平台实现低成本、高效率的攻击链。对网络安全从业者而言，这是典型的“硬件+软件+AI”协同攻击案例，凸显了供应链安全和设备固件审计的重要性；对广告行业则警示了流量来源真实性验证的紧迫性。

技术解析

• H96 电视盒子预装来自 Zhejiang Fengwo IoT Technology Ltd 的两个应用，这些应用会向指定域名上报设备信息，但伪造为 Samsung、Vivo、Huawei、Xiaomi 等手机型号。
• Fengwo Group 使用 Google Blockly 的私有版本构建虚假网站，员工无需编程知识即可拖拽代码块生成含AI文章的钓鱼页面，并导出为JavaScript上传至S3存储桶。
• 欺诈引擎集成多模态视觉与推理系统，使H96设备能在网页中定位广告元素并模拟真人点击行为，同时避免被检测为机器人。
• 设备具备环境感知能力：通过监测HDMI输入判断是否连接电视——有信号时开启代理模式，无信号时进入待机等待欺诈指令。
• 所有通信流量经由 fwgcloud[.]com 域名协调，该域名与恶意应用共享SSL证书，且背后关联香港、新加坡及个人名义注册的收款实体。

行业启示

• 厂商应加强对第三方预装应用的签名校验与运行时行为监控，防止类似“后门式”固件篡改事件重演。
• 广告网络需引入更严格的设备指纹交叉验证机制，特别是针对非典型访问源（如电视盒冒充手机）进行异常流量拦截。
• 低代码/无代码平台虽提升开发效率，但也可能被滥用构建自动化攻击体系，建议增加敏感操作审批日志与输出物沙箱审查机制。