H96 Android TV Boxes Used for Ad Fraud and Residential Proxies
H96 Android TV boxes found with Fuyao software for ad fraud and residential proxies.
Security researchers discovered that some inexpensive H96 Android TV boxes come pre-installed with Fuyao software. This software can disguise the devices as smartphones, generate fraudulent ad clicks, and route other users' internet traffic through the owners' home connections, effectively turning them into residential proxies.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bitsight?
Get an email when a new story names Bitsight, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonH96 Android TV boxes shipped with Fuyao malware pre-installed represent a classic supply chain compromise, where malicious software is embedded in devices before they ever reach the consumer. Buyers have no visibility into the firmware supply chain and unknowingly introduce compromised hardware into their home networks. This matters because the infected devices abuse the owner's internet connection for ad fraud and as residential proxies, potentially implicating innocent users in malicious activity and degrading their network performance. The low cost of these devices incentivizes manufacturers to monetize firmware space with adware or malware, a growing threat in the consumer IoT market.
What helps against this
How we list vendors
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.