Bitsight uncovered the Fuyao operation, in which cheap Android TV boxes shipped by Zhejiang Fengwo IoT Technology ship with pre-installed applications that rewrite device hardware identity to masquerade as Samsung, Huawei, Xiaomi, or Vivo phones for ad fraud. When an HDMI signal is detected, the device switches to relaying third-party traffic through the owner's broadband connection as a SOCKS5 exit node. Bitsight discovered the operation by registering an expired domain previously used as a factory backdoor and telemetry collector. The most commonly identified device model was H96_MAX_V11.

See: Cyber Digest — 2026-08-01