Security researchers warn cheap H96 Android TV streaming boxes are tied to proxy abuse and large-scale mobile ad fraud

Bitsight researcher Pedro Falé found that some H96 streaming devices were phoning home through an expired domain he acquired, exposing a network that collected device data and disguised TV boxes as smartphones. The devices appeared to run apps linked to Zhejiang Fengwo IoT Technology that generated fake ad clicks on AI-made sites, part of a broader ad fraud operation.

The findings highlight how bargain streaming hardware can become part of hidden monetization schemes that exploit users’ home networks and undermine digital advertising markets. As low-cost connected devices proliferate, supply-chain security and app transparency are becoming critical consumer and platform risks.