120,000 Android TV Boxes Were Renting Out Their Owners' Home Internet

A cheap Android TV box under the television is rarely treated as part of the home network's attack surface. Researchers at Bitsight have just shown why it should be. A fleet of budget streaming boxes shipped with a factory backdoor that runs two businesses at once: click fraud on advertising, and a residential proxy exit node that relays strangers' traffic through the owner's home internet connection.

An expired domain opened the whole operation

The investigation started by accident. Bitsight researcher Pedro Fale registered an expired domain that had been used for backdoor telemetry on Android TV boxes. Instead of silence, devices in the field started reporting in: more than 65,000 reports from roughly 38,000 unique MAC addresses in a single day. Most of them identified themselves not as TV boxes, but as phones.

The researchers named the operation Fuyao. The sinkhole data was skewed toward older models of a single brand, H96, so 38,000 is a floor rather than a ceiling: the operators themselves advertise a network of more than 120,000 devices.

One box, two jobs, and the HDMI cable decides

The most unusual part of Fuyao is how it schedules the work. The malware checks whether an HDMI cable is connected, which is a reliable signal for whether anyone is actually watching:

• HDMI connected: the box becomes a SOCKS5 exit node and relays other people's traffic through the owner's connection.
• HDMI disconnected: the box switches to ad fraud, spoofing the hardware identity of popular Samsung, Huawei, Xiaomi and Vivo phone models and clicking ads on websites the operators run themselves.

The device earns money around the clock, and the mode that puts a stranger's traffic behind the owner's IP address runs exactly when the household is watching television.

Machine vision and a children's coding tool

To find advertising slots on a page, the malicious app carries a YOLOv8s object detection model trained on twelve screen elements, including generic banner regions and Taboola widgets, and combines it with Android accessibility data and Google ML Kit optical character recognition. The campaign logic itself is assembled in Blockly, the drag-and-drop visual language Google built to teach children programming: staff snap blocks together in a custom editor, export the result as JavaScript, and upload it to cloud storage for the infected boxes to fetch. Bitsight captured roughly 166 fraud modules across two collection runs.

The economics are modest per device and large in aggregate. A conservative estimate of one dollar to $1.25 per device per day works out to about $150,000 a day across the advertised fleet, and up to $40 million a year once fraud filtering and ad-fill rates are taken into account.

Why a proxy node in the living room is the owner's problem

One in six Fuyao boxes overlapped with commercial residential proxy data within a 24 hour window, and one in four within seven days. Bitsight reads this as the operators renting out bandwidth to residential proxy providers, the services that sell "clean" home IP addresses to anyone who wants traffic that does not look like a data centre.

For the person who bought the box, this is not an abstract problem. Scraping, credential stuffing, ticket bots and fraud attempts leave the household's public address in the logs of whoever gets hit. The practical consequences arrive later and look unrelated: constant CAPTCHAs, blocked services, banned accounts, complaints from the internet provider. The same pattern showed up in the NetNut network built on two million hijacked devices, which the FBI and Google dismantled in July.

Read more: FBI and Google dismantle the NetNut proxy botnet built from two million hijacked devices.

How to check a box you already own

Google confirmed that the devices in question are not Play Protect certified, meaning they never went through Android compatibility and security testing. Neither Bitsight nor the reporting establishes who installed the apps or at which point in the supply chain they appeared, and no complete list of affected models exists.

• Check certification: Google publishes a list of Play Protect certified Android TV devices; a box that is not on it has no security testing record.
• Watch the traffic, not the screen: a box that keeps uploading while nobody is watching is the clearest symptom. Router statistics or the provider's app will show it.
• Update the firmware from the manufacturer's own channel, and remove devices that never receive updates at all.
• Treat "free content" hardware as suspect. The FBI's advice after earlier campaigns was blunt: assess connected devices, disconnect the suspicious ones, and be wary of generic streaming boxes sold on the promise of free television.

What this changes for home network hygiene

The useful lesson from Fuyao is that the weakest device on a home network defines its reputation. A privacy toolkit that covers a laptop and a phone while a no-name box streams unknown traffic from the same address is protecting the wrong perimeter. Encrypted tunnels are worth having for what they do well: keeping browsing away from the provider and away from whoever runs the public Wi-Fi. What they cannot do is take responsibility for hardware that was compromised before it left the factory. Isolating cheap smart devices on a guest network, or removing them entirely, does more for the household's IP address than any subscription.