Android TV Botnet Masquerades as Millions of Phones
The break is not the click fraud itself. The break is that cheap Android TV boxes are being sold to ad systems as ordinary phones, so the same hardware can look like a rotating pool of separate users and stay profitable for years. That identity layer is what defeats basic device-fingerprint and IP-based fraud controls.
Bitsight says the operation, Fuyao, uses preinstalled Android apps, device identity spoofing, AI-generated websites, and residential proxies to generate ad revenue without owners knowing. The researchers estimate more than 120,000 devices are advertised publicly, saw nearly 38,000 unique MAC addresses in 24 hours, and tied payout accounts to shell companies linked to Google AdSense and Taboola.
The risk is a commercialized fraud fleet that keeps changing its face. If a trust stack relies on a stable device identity or a single residential IP, the fraud can keep routing around those checks and pollute ad inventory and telemetry at scale.