Fuyao operation uses Android TV boxes for ad fraud

The Hacker News reports that a sophisticated ad fraud operation dubbed Fuyao has been discovered, leveraging cheap Android TV boxes to mimic smartphones and generate fraudulent ad revenue. The operation, attributed to Zhejiang Fengwo IoT Technology Co., Ltd., utilizes apps that rewrite hardware identities and perform click fraud, according to research by Bitsight.

The Fuyao operation employs apps on Android TV boxes that spoof hardware identities to impersonate popular smartphone brands like Samsung, Huawei, Xiaomi, and Vivo. These apps then engage in ad fraud by clicking on ads hosted on websites operated by the fraudsters. Additionally, when an HDMI signal is detected, the devices switch to acting as SOCKS5 exit nodes, relaying other users' traffic through the owner's internet connection. Once the HDMI signal is removed, the devices revert to their ad-fraud tasks.

Bitsight researchers uncovered the operation by monitoring an expired domain used for factory backdoors and telemetry. Analysis revealed that a single day saw over 65,000 reports from approximately 38,000 unique MAC addresses, with most devices reporting as phones. The command-and-control server pushes customized phone profiles to the devices, masking their underlying hardware. Fuyao utilizes machine vision, including object detection models and optical character recognition, to locate and interact with ads. Campaign logic is assembled using a drag-and-drop framework, with fraud routines exported as JavaScript.

Bitsight estimates potential daily earnings of $47,500, with annual revenue possibly reaching $40 million, though these are estimations based on active devices and ad-fill rates. For users, guidance includes verifying Play Protect certification and disconnecting suspicious devices from the network.

Source: The Hacker News