A sophisticated ad fraud operation, dubbed "Fuyao" by researchers, has been uncovered, leveraging preinstalled Android applications, device identity spoofing, AI-generated websites, and residential proxy services to generate illicit advertising revenue. The multi-million dollar scheme, which had reportedly operated unnoticed for several years, was discovered during an investigation into factory-installed remote-management backdoors on Android TV boxes.
The operation's business model is designed to maximize revenue by accurately identifying ad placements on websites, spoofing devices to appear as premium mobile phones for higher click values, and mimicking human behavior to evade bot detection. The operators publicly advertise a network of over 120,000 devices, marketed as "AI digital humans." Telemetry collected by researchers from a sinkhole domain recorded nearly 38,000 unique MAC addresses over a 24-hour period, though this figure does not represent the total number of infected devices due to identity spoofing. Researchers estimate the operation could generate up to $40 million annually, even after accounting for fraudulent clicks and impressions detected by advertising platforms. Publisher accounts used for ad payouts have been linked to shell companies registered in Hong Kong and and Singapore, associated with Google AdSense and Taboola.
The discovery was accidental, initiated by researcher Pedro Falé while investigating persistent backdoors on Android TV boxes. He found an expired domain used by one such backdoor. After registering the domain, the Bitsight TRACE team began receiving telemetry from devices still attempting to contact it. Unexpectedly, the reports came not only from Android TV boxes but also from devices identifying as popular Android phones like Xiaomi, Samsung, Huawei, and Vivo. While the hardware information matched phone models, some devices contained software packages typically found on Android TV boxes, such as TV launchers and settings apps. Two recurring applications found across both phone profiles and TV boxes provided the initial link to the larger Fuyao operation.
The Fuyao enterprise utilizes a multi-tiered command-and-control (C2) infrastructure with hardcoded IP addresses and ports for initial contact and persistent WebSocket connections. This includes tiers for initial contact, spoofing, and maintaining WebSocket connections, alongside S3 buckets for configuration and file sharing. Infected TV boxes operate in two modes: ad-fraud mode and residential proxy mode. In ad-fraud mode, devices browse attacker-operated websites, many featuring AI-generated articles on topics like finance, health, and food. Ad units on these sites are often displayed only to mobile visitors, prompting the bots to present spoofed phone properties. To interact with ads realistically, the applications combine Android's accessibility services with a YOLO computer vision model and OCR text recognition, allowing bots to locate and click banners or content recommendation widgets even if site layouts change. Unused code was also identified, designed to call Azure's GPT-4o model for navigation and click decisions, though it was not actively connected to the running applications.
The operational mode of the TV boxes appears to depend on their display connection. When an HDMI cable is connected, the device primarily functions as a residential SOCKS5 proxy, forwarding third-party internet traffic through the owner's home network. When disconnected, it tends to perform ad-fraud tasks. Overlap with residential proxy data was observed in at least one out of six TV boxes daily, and one out of four weekly, suggesting a secondary revenue stream from selling bandwidth.
A notable aspect of the operation is the use of Blockly, a visual, drag-and-drop programming language originally developed by Google to teach children coding. Fuyao operators build their fraud logic by assembling blocks in a custom editor, then exporting the result as JavaScript and uploading it to cloud storage for infected devices to execute. A translated developer comment indicated this approach reduces operational costs by lowering the technical requirements for developers creating execution units from templates. By registering test devices on the botnet and recording task pushes, researchers captured approximately 166 fraud modules covering browser launching, cache and tab cleanup, page navigation, ad detection, telemetry, and website-specific logic. New campaigns against different targets reuse most underlying modules, adding only specific URLs, click rates, and browser mixes. Researchers concluded that Fuyao deviates from traditional, low-effort ad fraud, representing a dedicated company focused entirely on this fraudulent activity.
