[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRPCweCsvIqqux9VLh519i-iO6NzMFUka434k67yOGd4":3},{"article":4,"iocs":56,"watch_terms":57,"solutions":58,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"3806efc2-60dd-41e8-8cde-fd7807ed0d2f","Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies","cheap-android-tv-boxes-pose-as-phones-and-turn-owners-broadband-into-proxies-8a2c99","Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company founded in 2019. The same apps have a second job. When a box","A campaign named Fuyao, attributed to Chinese company Zhejiang Fengwo IoT Technology Co., Ltd., is hijacking cheap Android TV boxes. These devices are reprogrammed to mimic phone hardware, click ads on operator-controlled websites, and also function as SOCKS5 proxy nodes using the owner's broadband. Bitsight researchers discovered the operation through a sinkhole of an expired domain used for factory backdoor and telemetry collection.","Android TV boxes are being hijacked to mimic phones, click ads, and act as proxy nodes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcheap-android-tv-boxes-pose-as-phones.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjhxfc7_NuArKSujgjgzPzENagYVTlBxcvnFBXSbptnFs_TI1o-Zt5SINHtPEO5MNkJ3vwkKUTX68vwmCzVxRQVFcgnb9eXwAsLKayCtzMLVRuqwV3RDaWTgQNOm0CVXcV_jX1v4x4mgEthTDjAsZdF4BSPSuTTRqKnM6qbIhPVjZP38dHmpptNurSmXRM\u002Fs1600\u002Fandroid-tv.jpg","2026-07-31T14:45:01+00:00","2026-07-31T16:00:36.289306+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Fuyao","threat_actor",{"name":21,"type":22},"Zhejiang Fengwo IoT Technology Co., Ltd.","vendor",{"name":24,"type":25},"H96_MAX_V11","product",{"name":27,"type":28},"SOCKS5","technology",{"name":30,"type":28},"Blockly",{"name":32,"type":28},"YOLOv8s","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24],{"controls":59,"vendors":138},[60,88,109],{"slug":61,"name":62,"problem":63,"products":64},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[65,72,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":67,"url":70,"description":71},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[93,101],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":110,"name":111,"problem":112,"products":113},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[139],{"slug":140,"name":141,"logo_path":142,"roles":143},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":159},"cheap-android-tv-boxes-ship-with-factory-backdoors-hijack-home-broadband-as-proxy-nodes","Cheap Android TV Boxes Ship With Factory Backdoors, Hijack Home Broadband as Proxy Nodes","The Fuyao campaign reveals how low-cost IoT devices can arrive pre-compromised at the hardware or firmware level, with factory backdoors deliberately embedded by the manufacturer — in this case linked to Zhejiang Fengwo IoT Technology Co., Ltd. Consumers unknowingly become part of a criminal proxy network, with their broadband bandwidth monetized for ad fraud and SOCKS5 proxy services without any interaction on their part. This matters because the attack surface exists before the device is even unboxed, making traditional endpoint security and patching largely ineffective. It also demonstrates how expired domains and sinkholing can serve as critical investigative tools to uncover hidden command-and-control infrastructure baked into consumer electronics.",[150,151,152,153,154,155,156,157,158],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST IR-4: Incident Handling","NIST SC-7: Boundary Protection","NIST SA-12: Supply Chain Protection","ETSI EN 303 645: Cybersecurity for Consumer IoT","GDPR Article 32: Security of Processing (for EU-based users whose bandwidth and data are misused)",{}]