A company exploits AI and kids' apps for a $40 million ad fraud empire
A security investigation into cheap Android TV boxes led to the discovery of a long-hidden ad fraud operation, dubbed Fuyao. According to Bitsight, this network uses preinstalled Android apps, device identity spoofing, AI-generated websites, and residential proxy services to generate ad revenue without user consent.
A sophisticated business model
The Fuyao operational model relies on the ability to identify the location of an ad on a website, spoof the device as a smartphone to obtain more lucrative clicks, and mimic human behavior to avoid being detected as bots. Operators advertise a network of over 120,000 devices, marketed as "AI digital humans".
Bitsight recorded telemetrics from nearly 38,000 unique MAC addresses in 24 hours, although this number does not reflect the actual number of infected devices due to the rotation of spoofed identities. With an estimated revenue of $1 to $1.25 per device per day, the operation could generate up to $40 million annually, even after accounting for fraudulent clicks and impressions detected by advertising platforms.
An operation discovered by chance
Researcher Pedro Falé discovered the operation while investigating factory-enabled remote management backdoors left on Android TV boxes sold to consumers. During the investigation, he noticed that one of the domains used by the backdoor had expired. The Bitsight TRACE team registered the domain and began receiving telemetrics from devices still attempting to contact it.
Initially, researchers expected to receive telemetrics from Android TV boxes, but instead the server received reports from devices identifying themselves as Xiaomi, Samsung, Huawei, Vivo phones, and others. The hardware information matched the phone models, although some devices contained software packages normally found on Android TV boxes, including TV launchers and settings apps.
By comparing the installed applications, researchers identified two recurring apps present on both phone profiles and TV boxes, becoming the first clue of a larger operation.
Artificial vision fuels Fuyao's ad fraud
The Enterprise Fuyao consists of multiple layers of command and control (C2) servers, each with different purposes. The system relies on a set of hardcoded IP addresses and ports for initial contact and to establish persistent WebSocket connections. One layer is dedicated to initial contact, a second to spoofing, and a third to maintaining the persistent WebSocket connection. There are also S3 buckets for sharing configurations and files.
Once active, a Fuyao-infected TV box can operate in one of two modes. In ad fraud mode, the device browses websites managed by the attackers, many of which are filled with AI-generated articles on topics such as finance, health, and food. The ad units on these sites only appear to visitors who seem to be mobile devices, so the bots present spoofed phone properties to pass this check before clicking the ads.
To find and interact with ads as a person would, the apps combine Android's accessibility services with a YOLO artificial vision model and OCR text recognition. This allows a bot to locate a banner or content recommendation widget on the screen and click it, rather than relying solely on scripts that stop working when a site's layout changes.
Researchers identified unused code written to call Azure's GPT-4o model to decide where to click and navigate next, although it did not appear to be connected to the running apps.
The apps change behavior depending on whether the TV box is connected to a display. When an HDMI cable is connected, the device tends to function as a residential SOCKS5 proxy, forwarding third-party internet traffic through the owner's home network. When the cable is disconnected, it tends to perform ad fraud tasks instead.
The overlap with residential proxy data appeared in at least one in six TV boxes in a day and one in four in a week. This suggests that the broadband of infected home networks is sold to proxy customers as a second revenue stream.
Built with a kids' programming tool
One detail particularly caught the attention. Operators build their fraud logic using Blockly, a visual, block-based programming language that Google designed to teach children the basics of coding. Staff assemble the campaign logic by dragging the blocks together in a custom editor, then export the result as JavaScript and upload it to cloud storage for execution on infected boxes.
A comment left by a Fuyao developer, translated by Bitsight, explained the motivation. "Only a small number of highly qualified developers are needed to build the template execution unit images; the developers who create the execution units from those templates have significantly lower technical requirements (...) greatly reducing the company's operating costs".
By registering test devices on the botnet and recording the task pushes sent to them in two separate executions, Bitsight captured approximately 300 unique fraud modules. These modules demonstrate the adaptability and scalability of the Fuyao operation.
By comparing the installed applications, researchers identified two recurring apps present on both phone profiles and TV boxes, becoming the first clue of a larger operation.
Artificial vision fuels Fuyao's ad fraud
The Enterprise Fuyao consists of multiple layers of command and control (C2) servers, each with different purposes. The system relies on a set of hardcoded IP addresses and ports for initial contact and to establish persistent WebSocket connections. One layer is dedicated to initial contact, a second to spoofing, and a third to maintaining the persistent WebSocket connection. There are also S3 buckets for sharing configurations and files.
Once active, a Fuyao-infected TV box can operate in one of two modes. In ad fraud mode, the device browses websites managed by the attackers, many of which are filled with AI-generated articles on topics such as finance, health, and food. The ad units on these sites only appear to visitors who seem to be mobile devices, so the bots present spoofed phone properties to pass this check before clicking the ads.
To find and interact with ads as a person would, the apps combine Android's accessibility services with a YOLO artificial vision model and OCR text recognition. This allows a bot to locate a banner or content recommendation widget on the screen and click it, rather than relying solely on scripts that stop working when a site's layout changes.
Researchers identified unused code written to call Azure's GPT-4o model to decide where to click and navigate next, although it did not appear to be connected to the running apps.
The apps change behavior depending on whether the TV box is connected to a display. When an HDMI cable is connected, the device tends to function as a residential SOCKS5 proxy, forwarding third-party internet traffic through the owner's home network. When the cable is disconnected, it tends to perform ad fraud tasks instead.
The overlap with residential proxy data appeared in at least one in six TV boxes in a day and one in four in a week. This suggests that the broadband of infected home networks is sold to proxy customers as a second revenue stream.
Built with a kids' programming tool
One detail particularly caught the attention. Operators build their fraud logic using Blockly, a visual, block-based programming language that Google designed to teach children the basics of coding. Staff assemble the campaign logic by dragging the blocks together in a custom editor, then export the result as JavaScript and upload it to cloud storage for execution on infected boxes.
A comment left by a Fuyao developer, translated by Bitsight, explained the motivation. "Only a small number of highly qualified developers are needed to build the template execution unit images; the developers who create the execution units from those templates have significantly lower technical requirements (...) greatly reducing the company's operating costs".
By registering test devices on the botnet and recording the task pushes sent to them in two separate executions, Bitsight captured approximately 300 unique fraud modules. These modules demonstrate the adaptability and scalability of the Fuyao operation.
The challenges of fighting ad fraud
The complexity and sophistication of the Fuyao operation highlight the challenges that advertising platforms and regulatory authorities face in combating fraud. The use of advanced technologies such as artificial vision and OCR allows Fuyao bots to quickly adapt to changes in websites, making traditional fraud detection methods ineffective.
Moreover, the use of programming tools like Blockly to build fraud logic demonstrates how criminals can exploit technologies designed for educational purposes for illicit purposes. This approach lowers the threshold of technical competence required to participate in the operation, making it more accessible and scalable.
Implications for users and privacy
Users who own Android TV boxes infected by Fuyao are unaware that their devices are being used for illegal activities. Selling their broadband as a residential proxy not only generates revenue for criminals but also exposes users to potential security risks and privacy violations. Internet traffic forwarded through home networks could be intercepted or manipulated, putting users' personal information at risk.
The discovery of Fuyao underscores the importance of adopting proactive security measures, such as regularly updating devices and using antivirus software, to protect against such threats. Users should also be aware of the signs of a compromised device, such as an unexplained increase in broadband usage or abnormal device behavior.
Future perspectives
The complexity and scalability of the Fuyao operation suggest that ad fraud will continue to evolve, adopting increasingly advanced technologies to evade detection systems. Advertising platforms will need to invest in artificial intelligence and machine learning solutions to identify and block fraudulent activities in real time.
Regulatory authorities will need to collaborate internationally to dismantle criminal networks and prosecute those responsible. Information sharing and cooperation between different jurisdictions will be crucial to effectively combat this phenomenon.
The Fuyao operation represents a worrying example of how technology can be exploited for illicit purposes. Its discovery underscores the need for a proactive and collaborative approach to protect users and ensure the integrity of the advertising market.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.