Android TV Boxes Now Double as Residential Proxies
The break is no longer just ad fraud. Fuyao turns cheap Android TV boxes into a dual-use fleet: they can pose as phones for clicks, then switch into SOCKS5 relays that push other people’s traffic through the owner’s home broadband. That means the trust problem is the preinstalled app itself, because one device can quietly monetize both ad inventory and a residential IP.
Bitsight says the same preinstalled Android apps drive both behaviors. Sinkhole telemetry tied the operation to about 38,000 unique MAC reports in a day, and the broader network was advertised as more than 120,000 devices. The report also links the payout side to shell companies and says most identifiable devices in the telemetry looked like phones, even though the hardware was Android TV boxes such as H96_MAX_V11.
For owners, the impact is broader than wasted ad spend. A compromised box can make a household or office connection look like a residential proxy source, which brings abuse complaints and reputation damage that basic device hygiene may miss.