Your Cheap Streaming Stick Has a Night Job
Cheap Android TV boxes rent out your internet while you watch and click ads while you sleep. Residential proxies and ad fraud, explained in plain English.
You did not buy a cheap streaming box. You took in a lodger who works nights. Researchers found generic Android TV boxes that rent out your home internet while you watch, then click ads on machine-written news sites once the screen goes dark. The fraud engine was built in a coding tool made for children.
Sorted by price, ascending
Everyone who owns one of these bought it the same way. You searched for an Android TV box, sorted by price ascending, and the cheap end of the results looked like a pricing error. A box that plays 4K, with a remote, a power supply, an HDMI cable, and free shipping. You bought it. It arrived. It worked.
It still works. Hold onto that, because it is the most important fact in this story.
On July 30, 2026, Bitsight published research by Pedro Falé into a family of dirt-cheap Android TV boxes that arrive with software already on them, working for somebody else. Not "vulnerable." Not one bad sideloaded app away. Present on delivery. KrebsOnSecurity covered it the same day, which is how most people heard.
Falé named the operation Fuyao, after a word that runs through its code and roughly means to soar on a whirlwind. It works two shifts. Neither of them is yours.
Nerd to English
A residential proxy rents out your home internet connection, so that someone else's traffic reaches the internet wearing your address instead of theirs. Ad fraud is a machine pretending to be a person looking at an advertisement, so an advertiser pays for an audience that never existed. These boxes reportedly do both, on a rota, and the first one is what makes the second one possible at scale.
Take them separately, because they are two different businesses that happen to fit together beautifully.
Ad fraud is the revenue. Advertising pays out per impression and per click. Nobody at the payout end can see your living room, so "a person saw this ad" is always, mechanically, "a device reported that a person saw this ad." A box reporting about a thousand times a day is, in accounting terms, an audience. The research traced 144 websites owned by the operation, stocked with AI-generated articles across finance, health, education, gaming, music and food, and at least 84 of the 144 loaded one major ad network's tag. Read that twice. Nobody wrote those articles. Nobody read them. Money moved anyway.
The residential proxy is what makes fraud believable. Traffic from a data center smells like a data center: those address ranges are published, known, and heavily discounted by anyone paying for attention. Traffic from a house in a suburb looks like a customer. Your address is the credibility.
Two shifts
Here is the finding that gave this post its title, and it is keyed to something almost comically domestic: the HDMI signal.
While the cable is live and you are watching something, the box does proxy work, quietly renting out the connection you pay for. When the signal goes dark, it changes jobs and starts clicking ads. According to the research the two jobs mostly do not run at the same time, and the clicking would be invisible to you even if the screen were on.
Read that as a design decision, because that is what it is. Somebody sat down and thought about you. Not about your antivirus, because nobody installs antivirus on the box behind the television. About you, the only sensor in that room capable of noticing anything at all, and specifically about the hours you are not in it.
That is a night job. It has a shift pattern, and the shift pattern is built around not waking you.
How it lies, and what it was built with
Two details here are better than any of the technology.
The first is that the boxes lie about what they are, upward. They present themselves as phones, and the research names profiles for handsets from Samsung, Huawei, Xiaomi and Vivo, with the box's own cheap chipset concealed. Sites in the network checked the profile before serving ads, by criteria that differed from site to site. An off-brand TV box is a cheap audience. A flagship phone is an expensive one. So the box rounds itself up, the way people do on dating profiles, and the ad market pays the difference.
The second is what the fraud was assembled in. The click campaigns were built in a drag-and-drop block editor of the kind schools use to teach nine-year-olds to code, which exports the finished routine as working JavaScript. Snap the blocks together, ship the fraud. There is also a small computer-vision model on board, trained to recognise about a dozen kinds of on-screen element, so the box can look at a page and find the button the way a person would. One of the things it was taught to spot is the ad widget itself.
That is the state of the art in your cabinet: children's tooling, a vision model, and your electricity.
The receipts
The researcher found the boxes were configured to phone home to a domain that had expired, so he registered it and waited to see who called. In one 24-hour window, the sinkhole logged 65,957 device reports from roughly 38,000 distinct device identities.
Then he did the arithmetic out loud, which I appreciate. Roughly ten ad clicks per box per day at roughly a dime a click, plus impressions at a quarter per thousand, comes to about $1.25 per box per day. Across the identities he could actually see, that lands in the region of $47,500 a day. That is the picture as of July 2026.
Sit with the shape of that rather than the size of it. One expired domain, one researcher, one day, one piece of arithmetic. And now the hardware economics finally parse: if a box earns its makers a dollar and a bit every day for years, it does not need to be sold at a profit. The device was never the product. It is the delivery van, and you bought the van, you pay for the fuel, you provide the parking, and you thank the driver.
What this proves, and what it does not
Honesty section, as always.
The 38,000 is wrong in both directions at once, and the researcher says so. It counts device identities, not devices, and a single box can present more than one, so it probably overstates the hardware. It also counts only boxes that called the one domain he happened to control, mostly older models from one brand, so it certainly understates the operation. Anyone quoting 38,000 as a population has read neither the report nor this paragraph.
The daily revenue is a model, not a bank statement. It is a click rate times a payout rate times a device count, with assumptions layered in about how many clicks get flagged and how many ad slots fill. Treat it as an order of magnitude. The story does not change if it is half that. The operators, for their part, advertise a fleet several times larger than anything the sinkhole saw, which would make the real figure much bigger, but that is a number about themselves, from people whose entire business is inflating numbers about themselves.
The proxy claim needs care. Proxy software shipping on a device and a box being caught relaying somebody else's traffic are two different findings. On the second one the researcher had limited visibility, and reports at least one in six of the boxes he could see over a day, one in four over a week. So the capability looks standard and the observed use is common rather than universal. Anyone telling you every cheap box is definitely renting out your line is going further than the evidence goes.
The attribution is strong, and it is still not a verdict. The trail runs to a Chinese IoT company whose apps sit on the devices, whose own patents and applications describe machinery that matches how those apps work, and whose infrastructure shares certificate data with the fraud's domains. The paperwork is my favourite part of this story: somebody wrote the technique down and registered it with a patent office. But knowing who built a mechanism is not the same as knowing who decided to point it at you, who got paid, or at which step of a chain running through factories, firmware suppliers and resellers the software went in. That last question is genuinely open. I am reporting an attribution, not sentencing anyone from a blog.
And nobody can tell you whether yours is one of them. No warning light. No fan noise. No lag. From the sofa, a compromised box and a clean box are the same box, and that is not an accident either. Here is where you expect a checklist. You are not getting one. Everything I could honestly put in it is either useless on hardware that will never see an update, or a weekend project you have to already enjoy. There is no setting called "stop having a night job," and I would rather leave you with the mechanism than with a false errand.
Why you, a person with a normal life, might care
Your internet address has a reputation, and it is not entirely yours anymore. That is how residential proxies work in general, rather than a documented outcome of this case: services quietly grade traffic by where it comes from, and when someone else's business exits through your address, you inherit the grade. The captchas that never end. The bank app that suddenly wants to verify it is you. The site that just refuses, politely, forever. You would never connect any of it to the box behind the television, because why would you.
You also leave with a decoder for the whole aisle. Hardware priced below the sum of its parts is not generosity, and not always a scam. It is a business model, and the honest versions tell you what they are: ads you can see, a subscription, a slightly worse camera. When nothing in the deal explains the price, asking "what else is this selling" stops being cynical and becomes literacy. Try it on a smart plug. Try it on a free doorbell camera.
And a smaller consolation. Next time you read that an ad got some enormous number of views, you know that "views" is a number with a shadow, and that part of the audience lives in a cabinet under somebody's TV, watching nothing, clicking anyway.
The human part
The image I cannot shake is a lodger.
Something moved into your living room inside a cardboard box. It never uses the kitchen, never makes noise, never asks for a key, because the door was already open when it arrived. It pays no rent. It works while you are on the sofa, and it works after you have gone to bed, at two jobs you would not have agreed to, using your address on the paperwork. And in the morning it is a streaming box again, playing the show you asked for, cheerfully, for a price that still feels like a steal.
You did not buy a device. You took in a lodger with a whirlwind for a name, and you pay the utilities.
So: what is the cheapest thing plugged in at your house, and do you know what it does at three in the morning? If you have a theory, or a suspiciously chatty gadget, send it my way. I read all of them, and I have started keeping a list.
Sources
Primary source: Pedro Falé, Bitsight TRACE, "The Fuyao Enterprise: Building an Ad-Fraud Empire with AI and Kids' Coding Blocks" (July 30, 2026)
https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks
Coverage that surfaced it: KrebsOnSecurity, "Read This Before You Buy That TV Streaming Stick" (July 30, 2026)
https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/
Additional coverage of the same research, not independent corroboration: Swati Khandelwal, The Hacker News, "Cheap Android TV Boxes Pose as Phones and Turn Owners' Broadband Into Proxies" (July 31, 2026)
https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html
More Where This Came From
Plain-language translations of the machinery and the money behind the tech headlines. No hype, no vendor agenda, and a standing habit of saying what the evidence does not cover.