Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

The Fuyao campaign reveals how low-cost IoT devices can arrive pre-compromised at the hardware or firmware level, with factory backdoors deliberately embedded by the manufacturer — in this case linked to Zhejiang Fengwo IoT Technology Co., Ltd. Consumers unknowingly become part of a criminal proxy network, with their broadband bandwidth monetized for ad fraud and SOCKS5 proxy services without any interaction on their part. This matters because the attack surface exists before the device is even unboxed, making traditional endpoint security and patching largely ineffective. It also demonstrates how expired domains and sinkholing can serve as critical investigative tools to uncover hidden command-and-control infrastructure baked into consumer electronics.