Read This Before You Buy That TV Streaming Stick

Security researchers uncovered that H96-branded TV streaming devices shipped with pre-installed malware that silently spoofs mobile device identities to commit large-scale ad fraud. The root cause is a supply chain compromise, where a manufacturer (linked to Zhejiang Fengwo IoT Technology Ltd) deliberately embedded malicious code before devices reached consumers. This matters because end users have no visibility into the firmware running on cheap, generic devices and unknowingly become participants in criminal fraud operations. The incident highlights the danger of purchasing unvetted hardware from unknown vendors, as malicious functionality can be baked in at the factory level, making it nearly impossible to detect without specialized tools.