Read This Before You Buy That TV Streaming Stick

Summary: Bitsight researcher Pedro Falé registered an expired domain formerly used for telemetry by H96 TV streaming sticks and found tens of thousands of the devices reporting in as Samsung, Vivo, Huawei and Xiaomi phones, all running two apps tied to Zhejiang Fengwo IoT Technology Ltd. The report says the boxes act as a captive traffic source that clicks ads on Fengwo's AI-generated websites, and that roughly 38,000 devices phoning home to the domain imply ad fraud revenue near $50,000 a day, not counting residential proxy income.
Why it matters: The same sticks switch roles based on whether the TV is on: with an HDMI signal they relay residential proxy traffic for paying customers, and with the TV off they wait for ad fraud jobs - so a single cheap device on your network is both an ad-fraud bot and an open door for strangers using your IP address.

Read the original at Krebs on Security ↗

Topics: Data Breaches
Related: TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026
Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026
City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026