Check your cheap TV streaming stick tonight: researchers tracked 38,000 of them running ad fraud with the screen off

The box under your television may be working a second job while you sleep, and the check that catches it takes minutes.

Google publishes instructions for confirming that a streaming device runs the official Android TV OS with Play Protect certification, and Synthient maintains a running list of IoT devices known to ship to consumers with residential proxy software; between them you can clear the box under your television in a few minutes. The reason to bother: Bitsight threat researcher Pedro Falé traced H96 sticks built by Zhejiang Fengwo IoT Technology to software that impersonates Samsung, Vivo, Huawei and Xiaomi phones in order to click ads on AI-generated websites, a network Krebs on Security reports brings in close to $50,000 a day. Bitsight tracked roughly 38,000 TV boxes globally phoning home to an expired Fengwo Group domain, and the same hardware resells residential proxy access while the television is actually in use.