The bottom line: Chinese Zhejiang Fengwo IoT Technology Ltd exploits H96 streaming sticks as botnets to defraud advertising networks using spoofed device identities.
Security researchers at Bitsight have uncovered that popular H96 TV streaming sticks are not only misusing internet connections, but are also being systematically deployed as bots to generate fake clicks on advertisements. Coordination is being handled by a Chinese group called Zhejiang Fengwo IoT Technology Ltd, which ships the devices with custom apps that masquerade as various Android smartphones.
Threat researcher Pedro Falé from Bitsight TRACE gained insight into an extensive ad fraud network by taking over an expired domain name. The domain was previously responsible for telemetry and regularly collected complete hardware information and a list of all installed apps from tens of thousands of H96 streaming sticks worldwide.
In analyzing the traffic, Falé discovered that nearly all TV boxes transmitted their data under false identities – claiming to be Samsung, Vivo, Huawei, or Xiaomi smartphones. All devices reported the same two apps as installed, both developed by Zhejiang Fengwo IoT Technology Ltd, a company founded in 2019 in mainland China that operates an advertising network under the name Fengwo Group and holds patents corresponding to the functionality of these apps.
The apps coordinate an ad fraud system in which H96 devices serve as a source for automated clicks on advertisements on AI-generated websites belonging to the Fengwo Group. These websites contain machine-produced news articles and graphics on various topics such as finance, health, education, gaming, music, and food blogs. Crucially: advertisements are only displayed on pages when accessed from a device using the spoofed mobile identity of an H96 stick.
The Fengwo Group presents itself on its domain fwgcloud[.]com as a company that redefines the boundaries of human-AI interaction and offers over 120,000 so-called “AI digital humans” for rental – ranging from emotional support to 24/7 customer service. Bitsight found that the Fengwo Group uses the visual programming language Blockly (originally developed by Google for computer science education) to create the fake websites, enabling even unskilled operators to assemble websites without needing to understand the underlying code blocks.
Source: krebsonsecurity.com · Published 30 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.