A security researcher has discovered that inexpensive TV streaming sticks called H96 boxes have been secretly turned into tools for a large-scale advertising scam, run by a Chinese advertising company.

Pedro Falé, who works at the security firm Bitsight, found an expired website address that the scammers had been using to control fraudulent ad clicks across H96 streaming devices. By taking over that web address, Falé was able to see data flowing in from tens of thousands of H96 sticks around the world. The data included detailed hardware information and the full list of apps installed on each device. Bitsight published Falé's findings in July 2026, and journalist Brian Krebs covered the story the same month. KrebsOnSecurity

The data revealed a clear pattern. Nearly all of the H96 devices were pretending to be mobile phones made by companies like Samsung, Vivo, Huawei, and Xiaomi. Every device had the same two apps installed, both made by a company called Zhejiang Fengwo IoT Technology Ltd. Founded in 2019 in mainland China, the company runs an advertising business under the name Fengwo Group. KrebsOnSecurity

Here is how the scam works. The two apps on the H96 sticks make the devices automatically click on ads shown on websites that Fengwo Group created. These websites look like normal news and blog sites, covering topics like finance, health, education, gaming, music, and food. But the ads on these sites only appear when the visitor is one of the compromised H96 sticks pretending to be a phone. If a real person visits the same website from a computer or an actual phone, they see no ads at all. This filtering is designed to hide the fraud from the automated systems that ad companies use to catch fake traffic. KrebsOnSecurity

The evidence tying Fengwo Group to this scheme goes beyond the apps themselves. Fengwo's web domain fwgcloud[.]com shared security certificate information with other web addresses linked to the H96 spoofing setup. That same domain hosts an internal company wiki connecting Fengwo to a custom version of Google's Blockly, a visual programming tool. Fengwo Group has also filed patents that match how the two apps on the H96 devices work. KrebsOnSecurity

Bitsight's TRACE team also found that Fengwo Group used several shell companies — businesses that exist only on paper — registered in Hong Kong and Singapore, including some set up under single individuals, to collect the money earned from the ad fraud. KrebsOnSecurity Bitsight

The fwgcloud[.]com domain also claims that Fengwo has created more than 120,000 "AI digital humans" — computer-generated characters — available for rent. That suggests the company's business extends well beyond ad fraud into making synthetic content at a very large scale. KrebsOnSecurity

Bitsight has been tracking this kind of threat for years. In March 2019, the company published a report finding that a fraudulent advertising software package had been installed on over 15 million devices. As part of that earlier investigation, Bitsight took control of a related web address using the same technique. Bitsight Wired reported in October 2023 that the operation also involved dozens of Android and iOS phone apps, not just TV streaming devices, showing that the fraud reaches across multiple types of devices. Wired

The H96 devices are cheap Android-based TV boxes sold mostly through online marketplaces. People who buy them almost certainly do not know that the devices come with hidden apps designed to silently participate in ad fraud. The sticks pretend to be mobile phones so their automated traffic looks like real mobile ad views, then send that traffic to the AI-generated content sites that serve ads only to matching fake device profiles. The result is a closed loop: the same operator controls the devices generating the traffic, the websites showing the ads, and the shell companies collecting the money. Each part is designed to be invisible to a different kind of investigator.

Using AI-generated content sites is a step up from older ad fraud methods. Previous operations typically stole ad space from legitimate websites or threw together obvious fake sites. Fengwo's network creates entire websites with machine-written articles and graphics across many topics, making them look like real publishers to any ad network that checks the destination. The device-filtering trick means that ad company scanners and human investigators see what looks like a normal website, while only the compromised H96 sticks trigger actual ads.

The shell company structure Bitsight traced through Hong Kong and Singapore follows a familiar pattern for operations that want to collect fraudulent ad revenue across different countries while hiding who ultimately owns the business. The single-person shell identities suggest a layered approach to collecting payments, designed to make financial tracing harder.

The broader context here is that this operation combines two things — cheap connected devices and AI-generated content — in a way that makes each better at going undetected than it would be on its own. The H96 sticks are cheap enough that buyers have little reason to question what software runs inside them, and the AI-generated sites are convincing enough that ad networks see what looks like genuine content. Having covered ad fraud for the better part of two decades, I have watched the back-and-forth between scammers and ad networks go through several rounds, and the pattern is consistent: each time the detection side closes a gap, the fraud side finds a new combination of techniques to open another one. What stands out in this case is how the operator has built a complete system from end to end — controlling the devices, the content, and the payout channels — which reduces the chances that any outside party notices something wrong.

There is also a consumer angle worth flagging. The people who bought these H96 sticks almost certainly had no idea their devices were participating in ad fraud. The devices are inexpensive, widely available on popular online marketplaces, and work normally as TV streamers. The fraudulent activity happens silently in the background. Anyone who has purchased a low-cost Android TV box from an online marketplace in recent years has no straightforward way to find out whether their device is affected, and there is no simple software fix that will remove the hidden apps.