A security investigation into inexpensive Android TV boxes led researchers to an ad fraud operation that had remained unnoticed for several years.
Fuyao apps ecosystem (Source: Bitsight)
According to Bitsight, the operation, named Fuyao, uses preinstalled Android apps, device identity spoofing, AI-generated websites, and residential proxy services to generate advertising revenue without device owners’ knowledge.
“Fuyao’s business model operates under its ability to always identify where an ad lives on a website, spoof the device as a phone for more premium clicks, increasing revenue gained from each click and avoiding getting flagged as a bot by mimicking human behavior,” Bitsight explained.
The operators advertise a network of over 120,000 devices, marketed publicly as “AI digital humans.” Telemetry collected through Bitsight’s sinkhole recorded close to 38,000 unique MAC addresses over 24 hours. The researchers cautioned that this figure does not represent the number of infected devices because spoofed identities can rotate.
Using an estimated revenue of $1 to $1.25 per device each day, Bitsight calculated that the operation could generate as much as $40 million annually, even after accounting for fraudulent clicks and impressions detected by advertising platforms.
The researchers linked publisher accounts used to collect advertising payouts to shell companies registered in Hong Kong and Singapore. Those accounts were associated with Google AdSense and Taboola.
Discovered by accident
Researcher Pedro Falé uncovered the operation while investigating factory-installed remote-management backdoors that had been left enabled on Android TV boxes sold to consumers.
During the investigation, he found that one of the domains used by the backdoor had expired. The Bitsight TRACE team registered the domain and began receiving telemetry from devices that were still attempting to contact it. The researchers expected the telemetry to come from Android TV boxes, since the backdoor was part of their firmware.
Instead, the server received reports from devices identifying themselves as Xiaomi, Samsung, Huawei, Vivo, and other Android phones. The hardware information matched phone models, though some devices contained software packages normally found on Android TV boxes, including TV launchers and settings apps.
Comparing the installed applications revealed two recurring apps that appeared on both the phone profiles and the TV boxes. Those apps became the first clue that the devices were linked to a larger operation.
Computer vision powers Fuyao’s ad fraud
“The Fuyao Enterprise consists of multiple tiers of C2s, each serving different purposes. The system relies on a set of hardcoded IP addresses and ports for initial contact and to establish persistent WebSocket connections,” Bitsight said.
“One tier is dedicated to initial contact, a second to spoofing, and a third maintains the persistent WebSocket connection. There are also S3 buckets for sharing configs and files,” they added.
Once active, a Fuyao-infected TV box can run in one of two modes. In ad-fraud mode, it browses websites operated by the attackers, most of them stocked with AI-generated articles covering topics such as finance, health, and food.
Ad units on these sites appear only to visitors that look like mobile devices, so the bots present spoofed phone properties to pass that check before clicking the ads.
To find and interact with ads the way a person would, the apps combine Android’s accessibility services with a YOLO computer vision model and OCR text recognition. This lets a bot locate a banner or content recommendation widget on screen and click it instead of relying only on scripts that stop working when a site’s layout changes.
The researchers identified unused code written to call Azure’s GPT-4o model to decide where to click and navigate next, though it did not appear to be connected to the running apps.
The researchers say the apps switch behavior depending on whether the TV box is connected to a display. When an HDMI cable is connected, the device tends to operate as a residential SOCKS5 proxy, forwarding third-party internet traffic through the owner’s home network. When the cable is disconnected, it tends to perform ad-fraud tasks instead.
Overlap with residential proxy data appeared in at least one out of six TV boxes over a day, and one out of four over a week. This suggests bandwidth from infected home networks is sold to proxy customers as a second revenue stream.
Built with a children’s coding tool
One detail stood out. The operators build their fraud logic using Blockly, a visual, drag-and-drop programming language Google designed to teach children the basics of coding. Staff assemble campaign logic by dragging blocks together in a custom-built editor, then export the result as JavaScript and upload it to cloud storage for infected boxes to run.
Approximation of Blockly fraud modules (Source: Bitsight)
A comment left by one Fuyao developer, translated by Bitsight, explained the reasoning.
“Only a small number of highly-skilled developers are needed to build the template execution-unit images; developers who create execution units from those templates have significantly lower technical requirements (…) greatly reducing the company’s operating costs.”
By registering test devices on the botnet and recording the task pushes sent to them over two separate runs, Bitsight captured around 166 fraud modules, split into groups covering browser launching, cache and tab cleanup, page navigation, ad detection, telemetry, and logic specific to a targeted website.
A new campaign against a new target adds its own URL, click rate, and browser mix, reusing most of the underlying modules.
“Fuyao strays from traditional, low effort modus operandi of ad fraud. In fact, an entire company was created and is solely dedicated to building a product that conducts this fraudulent activity,” the researchers concluded.
