Full Report
Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company founded in 2019. The same apps have a second job. When a box
Analysis Summary
# Incident Report: Operation Fuyao - Android TV Box Supply Chain Botnet
## Executive Summary
Operation Fuyao is a sophisticated ad-fraud and proxy botnet operation involving cheap Android TV boxes (primarily the H96 MAX V11) pre-installed with malicious apps. These devices spoof mobile phone identities to perform automated ad fraud and act as SOCKS5 residential proxies, generating an estimated $47,500 in daily fraudulent revenue. The operation is attributed to the Chinese firm Zhejiang Fengwo IoT Technology Co., Ltd.
## Incident Details
- **Discovery Date:** July 30, 2026 (Reported by Bitsight)
- **Incident Date:** Ongoing; attribution links back to company founding in 2019
- **Affected Organization:** Consumers purchasing off-brand Android TV boxes
- **Sector:** IoT / Consumer Electronics
- **Geography:** Global impact; Sinkhole data shows 38,000+ unique devices globally; attribution to Mainland China
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-infection (at manufacturing or distribution stage)
- **Vector:** Supply Chain Compromise / Pre-installed Malware
- **Details:** Devices are shipped from the factory with "Fuyao" apps embedded in the firmware or pre-loaded.
### Lateral Movement
- **Details:** While traditional lateral movement isn't the primary goal, the devices function as SOCKS5 exit nodes, allowing external attackers to route traffic through the victim’s home network to bypass geo-blocking or IP reputation filters.
### Data Exfiltration/Impact
- **Details:** Hardware identities are rewritten to mimic Samsung, Huawei, Xiaomi, or Vivo phones. Broadband bandwidth is hijacked for proxy services.
### Detection & Response
- **Detection:** Bitsight researchers registered an expired domain used by the attackers as a factory backdoor/telemetry collector.
- **Response:** Researchers "sinkholed" the domain to intercept and analyze telemetry from tens of thousands of infected devices.
## Attack Methodology
- **Initial Access:** Pre-installed malicious applications in the device supply chain.
- **Persistence:** System-level apps that survive factory resets or are part of the base firmware.
- **Defense Evasion:** Rewriting hardware properties to delete traces of Rockchip/Allwinner chipsets; mimicking legitimate smartphone profiles (per-model diffs).
- **Discovery:** The malware monitors for HDMI signals; if no signal is detected (device is idle), it focuses on ad fraud; if active, it acts as a proxy.
- **Lateral Movement:** Functioning as a SOCKS5 proxy to facilitate third-party movement.
- **Impact:** Ad-fraud via YOLOv8s object detection (AI) to find and click ads; broadband hijacking for residential proxying.
## Impact Assessment
- **Financial:** Estimated $1.25 gross return per device/day; potential $40M annual revenue for operators.
- **Data Breach:** Exposure of device MAC addresses, IP addresses, and hardware configurations.
- **Operational:** Consumer broadband degradation due to proxy traffic; unauthorized use of electricity and network resources.
- **Reputational:** Brand damage to "white-label" Android TV manufacturers and reputable phone brands being spoofed.
## Indicators of Compromise
- **Network:** Telemetry beacons to operator-controlled domains (e.g., sinkholed factory backdoor domains).
- **File:** YOLOv8s model named `lourui_2`; Script app utilizing Google ML Kit and Blockly-based JavaScript modules.
- **Behavioral:** Device identifying as a mobile phone (Samsung/Huawei) in network logs despite being a TV box; presence of SOCKS5 traffic on port 1080 or non-standard ports.
## Response Actions
- **Containment:** Bitsight sinkholed the C2/telemetry domain to disrupt communication.
- **Eradication:** Difficult due to supply-chain nature; requires firmware replacement or device disposal.
- **Recovery:** Users advised to verify Play Protect certification and disconnect uncertified devices.
## Lessons Learned
- **Supply Chain Risk:** Low-cost IoT devices remain a high-risk vector for pre-installed malware.
- **AI-Driven Fraud:** Attackers are now using sophisticated computer vision (YOLOv8) to automate human-like interactions with ads.
- **Low-Code Malware:** The use of Google Blockly shows that malware operators are using "drag-and-drop" interfaces to allow non-technical staff to build fraud campaigns.
## Recommendations
- **Consumer:** Purchase only "Play Protect" certified Android devices from reputable brands.
- **Network Admins:** Monitor for "mobile device" signatures on networks where only wired/IoT devices are expected.
- **Industry:** Implement stricter hardware attestation and supply chain audits for white-label electronics.