AI and Kid-Friendly Coding Tools Fuel Multi-Million Dollar Android TV Ad Fraud Scheme
A sophisticated ad fraud operation dubbed Fuyao has been uncovered, leveraging inexpensive Android TV boxes, AI-generated content, and child-friendly coding tools to generate millions in illicit advertising revenue.
Security researchers have exposed a vast ad fraud operation named Fuyao that has been quietly generating millions of dollars annually by exploiting inexpensive Android TV boxes. The scheme, detailed by Bitsight, utilizes a complex ecosystem involving preinstalled applications, device identity spoofing, AI-generated websites, and residential proxy services to generate fraudulent advertising revenue without the knowledge of device owners.
The Fuyao operation's business model hinges on its ability to precisely identify ad placements on websites, spoof device identities to mimic premium mobile clicks, and evade bot detection by mimicking human browsing behavior. Operators publicly market a network exceeding 120,000 devices as "AI digital humans." Telemetry data indicates a significant number of unique MAC addresses, though the actual number of compromised devices is likely higher due to rotating spoofed identities.
Bitsight estimates the operation could be generating as much as $40 million per year, even after accounting for fraudulent clicks and impressions detected by advertising platforms. The illicit funds are reportedly collected through publisher accounts linked to shell companies in Hong Kong and Singapore, which are associated with major ad networks like Google AdSense and Taboola.
The discovery was serendipitous. Security researcher Pedro Falé initially investigated factory-installed remote-management backdoors on Android TV boxes. When a domain used by one of these backdoors expired, Bitsight registered it and began receiving telemetry. Unexpectedly, the data originated not from TV boxes, but from devices identifying as popular Android phone models, though some contained TV-specific software.
Further analysis revealed two recurring applications present on both the phone profiles and the TV boxes, serving as the initial clue to the larger operation. The Fuyao infrastructure comprises multiple tiers of command-and-control servers, dedicated to initial contact, spoofing, and maintaining persistent connections, with S3 buckets used for configuration sharing.
In its ad-fraud mode, infected TV boxes browse attacker-operated websites filled with AI-generated articles on various topics. To pass as human and click ads, the apps employ Android's accessibility services combined with a YOLO computer vision model and OCR text recognition, allowing them to locate and interact with ads more effectively than script-based methods.
Remarkably, the fraud logic is built using Blockly, a visual, drag-and-drop programming language typically used to teach children coding. This approach allows developers to assemble campaign logic by dragging blocks together in a custom editor, exporting the result as JavaScript. This significantly lowers the technical barrier for creating new fraud modules, enabling rapid deployment against new targets.
Beyond ad fraud, the TV boxes also function as residential proxy servers when connected to a display via HDMI. This provides a secondary revenue stream by selling bandwidth from unsuspecting users' home networks to third-party traffic forwarders, further obscuring the operation's true scale and impact.