[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV5o6M-ltHZXFahaWsFsDfvQCAnWQCZEBiuSCv1ptOhs":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3332b3ec-e26f-4e92-a505-6911e85ad7ea","H96 Android TV Boxes Used for Ad Fraud and Residential Proxies","h96-android-tv-boxes-used-for-ad-fraud-and-residential-proxies-5f7977","Bitsight found Fuyao software on H96 Android TV boxes, letting operators fake ad clicks and route proxy traffic through their owners' home internet connections.","Security researchers discovered that some inexpensive H96 Android TV boxes come pre-installed with Fuyao software. This software can disguise the devices as smartphones, generate fraudulent ad clicks, and route other users' internet traffic through the owners' home connections, effectively turning them into residential proxies.","H96 Android TV boxes found with Fuyao software for ad fraud and residential proxies.","https:\u002F\u002Fhackread.com\u002Fh96-android-tv-boxes-ad-fraud-residential-proxies\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fcheap-android-tv-boxes-used-ad-fraud-residential-proxies.jpg","2026-08-03T14:15:10+00:00","2026-08-03T16:00:13.134149+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"H96 Android TV Boxes","product",{"name":21,"type":19},"Fuyao",{"name":23,"type":24},"Bitsight","vendor",{"name":26,"type":24},"Zhejiang Fengwo IoT Technology Co., Ltd.",{"name":28,"type":24},"Fengwo Group",{"name":30,"type":31},"Android TV boxes","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,26,28],{"controls":53,"vendors":131},[54,82,103],{"slug":55,"name":56,"problem":57,"products":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":77,"url":80,"description":81},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[87,95],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":49,"name":104,"problem":105,"products":106},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[132],{"slug":133,"name":23,"logo_path":134,"roles":135},"bitsight","\u002Fvendor-logos\u002Fbitsight.png",[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":153},"pre-installed-malware-on-budget-android-tv-boxes-enables-ad-fraud-and-proxy-abuse","Pre-Installed Malware on Budget Android TV Boxes Enables Ad Fraud and Proxy Abuse","H96 Android TV boxes shipped with Fuyao malware pre-installed represent a classic supply chain compromise, where malicious software is embedded in devices before they ever reach the consumer. Buyers have no visibility into the firmware supply chain and unknowingly introduce compromised hardware into their home networks. This matters because the infected devices abuse the owner's internet connection for ad fraud and as residential proxies, potentially implicating innocent users in malicious activity and degrading their network performance. The low cost of these devices incentivizes manufacturers to monetize firmware space with adware or malware, a growing threat in the consumer IoT market.",[142,143,144,145,146,147,148,149,150,151,152],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST IR-4: Incident Handling","NIST SC-7: Boundary Protection","NIST SI-3: Malicious Code Protection","GDPR Article 5(1)(f): Integrity and Confidentiality of Personal Data","GDPR Article 32: Security of Processing","ETSI EN 303 645: Cybersecurity for Consumer IoT",{}]