THE FUYAO ENTERPRISE: BUILDING AN AD-FRAUD EMPIRE WITH AI AND KIDS' CODING BLOCKS

Summary from the TLDR InfoSec newsletter

The Fuyao botnet shipped pre-installed on Android TV boxes at the firmware level, spoofed device identities as premium smartphones (Vivo, OPPO, Huawei, and Meizu) via C2-pushed profile configurations, then used a fused Android Accessibility/YOLOv8s/OCR vision stack alongside Blockly-authored fraud modules to click ads and run residential SOCKS5 proxy sessions across a claimed 120K+ device fleet, generating an estimated $150K in daily revenue. Bitsight TRACE attributed the operation to shared SSL certificates, a leaked internal wiki, reused shell-company emails, and 6-8 of 20 CNIPA patent filings mapping to Fuyao subsystems, tracing the scheme through 144 AI-generated ad-landing domains and Hong Kong/Singapore shell publishers back to Zhejiang Fengwo IoT Technology, a subsidiary of the Fengwo Group. Defenders managing Android device fleets or CI-adjacent infrastructure should flag anomalous phone-model telemetry originating from TV-box hardware profiles and treat unexplained SOCKS5 proxy traffic or unaccounted ad-network impressions as indicators of this ecosystem.