Cheap Android TV sticks are secretly clicking ads and renting your internet

That cheap off-brand TV streaming stick in your living room might be running a hidden ad-fraud operation while you sleep.

Security firm Bitsight analyzed popular generic Android TV devices, including the H96 brand sold online. Researcher Pedro Falé told KrebsOnSecurity that tens of thousands of these boxes contain factory backdoors. The devices pretend to be smartphones from brands like Samsung or Xiaomi. When your TV is on, the box secretly routes residential proxy traffic through your home network. When you turn the TV off, it switches to ad fraud—opening AI-generated blogs and clicking ads to generate money for a Chinese firm called Fengwo Group.

Why it matters: You save money on hardware, but your home network pays the price. Your residential IP address gets exposed to unknown web traffic, and your bandwidth powers a background click farm without your consent.

Know this: If an off-brand streaming box promises cheap content, assume the factory software is subsidized by background malware. Stick to streaming devices from well-known manufacturers that supply regular security patches.

Turns out "cheap streaming" just means your TV stick works a night shift.