Krebs on SecurityBrianKrebs
Cheap Android TV Boxes Found Running Massive Ad Fraud Network
Part of the Boxes story · since 30 Jul
- Thu 30 Jul, 16:55 UTC. Krebs on Security, first report. Cheap Android TV Boxes Found Running Massive Ad Fraud Network. This article, 1st of 4.
- Fri 31 Jul, 16:08 UTC. The Hacker News, its first report on the story. Cheap Android TV boxes hijack home broadband for botnet attacks.
- Tue 11 Aug, 10:41 UTC. Unit 42, its first report on the story. New Kimwolf v7 Botnet Hits Android TV Boxes with Stealth DDoS.
- Wed 12 Aug, 09:51 UTC. Security Affairs, its first report on the story. Kimwolf v7 Botnet Leverages Ethereum, Chrome for DDoS.
Security experts are warning about generic TV boxes, like the H96, that often facilitate ad fraud and rent out users' internet connections without consent. Researcher Pedro Falé from Bitsight TRACE uncovered a vast ad fraud network linked to these devices, which spoof themselves as mobile phones to generate false ad clicks. The H96 boxes report incorrect data about their hardware and use apps from a Chinese company, Fengwo Group, to drive this fraudulent operation.
The company uses AI-generated websites to display ads and has built an operation that reduces the need for highly skilled developers. When the TV is off, the boxes engage in ad fraud; when on, they act as residential proxies. Bitsight estimates the ad fraud generates about $50,000 a day. Consumers are advised to stick with reputable, name-brand devices to avoid such risks.
How the story developed
4 articles from 4 outlets since 30 Jul. Quiet since 12 Aug. This was the first report.
- Thu 30 Jul, 16:55 UTC. Krebs on Security, first report. Cheap Android TV Boxes Found Running Massive Ad Fraud Network. This article, 1st of 4.
- Fri 31 Jul, 16:08 UTC. The Hacker News, its first report on the story. Cheap Android TV boxes hijack home broadband for botnet attacks.
- Tue 11 Aug, 10:41 UTC. Unit 42, its first report on the story. New Kimwolf v7 Botnet Hits Android TV Boxes with Stealth DDoS.
- Wed 12 Aug, 09:51 UTC. Security Affairs, its first report on the story. Kimwolf v7 Botnet Leverages Ethereum, Chrome for DDoS.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 4 articles as a listHide the list
- Thu 30 JulDay 01
- Cheap Android TV Boxes Found Running Massive Ad Fraud Network16:55 · Krebs on Security · First report · This article, 1st of 4
- Fri 31 JulDay 11
- Cheap Android TV boxes hijack home broadband for botnet attacks16:08 · The Hacker News
Quiet for 11 days
Tue 11 AugDay 121- New Kimwolf v7 Botnet Hits Android TV Boxes with Stealth DDoS10:41 · Unit 42 · Picked up again
- Wed 12 AugDay 131
- Kimwolf v7 Botnet Leverages Ethereum, Chrome for DDoS09:51 · Security Affairs