Bitsight ties H96 TV streaming boxes to an ad fraud network that spoofs mobile phones

Sources: primary, discussion
Summary: Krebs on Security reports Bitsight research linking H96 branded TV streaming boxes to an ad fraud network that presents its traffic as coming from mobile phones, and tracing the operation to Zhejiang Fengwo IoT Technology Co., Ltd, operating as the Fengwo Group through shell identities in Hong Kong and Singapore. Bitsight tracks about 38,000 devices and estimates revenue near $50,000 a day, and reports that a device relays residential proxy traffic while an HDMI signal is present and switches to ad fraud when the TV is off, never both at once. Neither Krebs nor Bitsight names specific device models or firmware versions beyond the H96 brand.
Why it matters: Hardware sold as a streaming stick is billable botnet capacity on whatever home or office network it is plugged into, and the named operator and revenue estimate separate this from the general warnings about cheap TV boxes that the article says have circulated for years.