Criminals have built a multimillion-dollar ad fraud empire using artificial intelligence and children’s coding software to run a massive network of infected devices.
A hidden botnet revealed by a forgotten domain
Security researchers stumbled upon the operation, named Fuyao, while investigating inexpensive Android TV boxes. The investigation began after a researcher named Pedro Falé noticed that a domain used by the boxes’ remote-management backdoors had expired. He registered the domain and expected to receive telemetry from the boxes, but instead, he received data from devices identifying themselves as smartphones.
The server received reports from devices claiming to be Xiaomi, Samsung, and Huawei phones. The software packages on these devices included TV launchers and settings apps, which are normally found on Android TV boxes. Comparing the installed applications revealed two recurring apps that appeared on both the phone profiles and the TV boxes, linking the two devices together.
The researchers expected the telemetry to come from Android TV boxes since the backdoor was part of their firmware. Instead, the server received reports from devices identifying themselves as Xiaomi, Samsung, Huawei, Vivo, and other Android phones. The hardware information matched phone models, though some devices contained software packages normally found on Android TV boxes, including TV launchers and settings apps.
How the fraud works
Fuyao’s business model relies on spoofing device identity to generate advertising revenue without device owners’ knowledge. The system uses preinstalled Android apps, device identity spoofing, AI-generated websites, and residential proxy services to bypass detection. According to the security firm Bitsight, the operation generates revenue by identifying where an ad lives on a website and spoofing the device as a phone for more premium clicks.
Computer vision powers the botnet’s ability to find and interact with ads. The apps combine Android’s accessibility services with a YOLO computer vision model and OCR text recognition to locate a banner or content recommendation widget on screen. This allows the bot to click the ad instead of relying only on scripts that stop working when a site’s layout changes.
Ad units on these sites appear only to visitors that look like mobile devices, so the bots present spoofed phone properties to pass that check before clicking the ads. The researchers identified unused code written to call Azure’s GPT-4o model to decide where to click and handle next, though it did not appear to be connected to the running apps.
Researchers say the apps switch behavior depending on whether the TV box is connected to a display. When an HDMI cable is connected, the device tends to operate as a residential SOCKS5 proxy, forwarding third-party internet traffic through the owner’s home network. When the cable is disconnected, it tends to perform ad-fraud tasks instead.
Using a tool for kids to run a complex scam
The most unusual detail of the operation is the programming method used to build the fraud logic. The operators assemble campaign logic by dragging blocks together in a custom-built editor using Blockly, a visual, drag-and-drop programming language Google designed to teach children the basics of coding. They then export the result as JavaScript and upload it to cloud storage for infected boxes to run.
One developer left a comment explaining the reasoning behind this approach. The comment, translated by Bitsight, stated that only a small number of highly-skilled developers are needed to build the template execution-unit images. Developers who create execution units from those templates have significantly lower technical requirements, which greatly reduces the company’s operating costs.
Bitsight captured around 166 fraud modules during two separate runs of the operation. These modules covered browser launching, cache and tab cleanup, page navigation, ad detection, telemetry, and logic specific to a targeted website. A new campaign against a new target adds its own URL, click rate, and browser mix, reusing most of the underlying modules.
Researchers say the network consists of multiple tiers of command-and-control servers. One tier is dedicated to initial contact, a second to spoofing, and a third maintains the persistent WebSocket connection. There are also S3 buckets for sharing configs and files. The researchers linked publisher accounts used to collect advertising payouts to shell companies registered in Hong Kong and Singapore. Those accounts were associated with Google AdSense and Taboola.
The security firm estimates that the operation could generate as much as $40 million annually. Using an estimated revenue of $1 to $1.25 per device each day, Bitsight calculated the potential earnings even after accounting for fraudulent clicks and impressions detected by advertising platforms. The researchers say the network advertises over 120,000 devices, marketed publicly as “AI digital humans.”
The botnet’s reliance on residential proxy services creates a security risk that extends beyond simple ad fraud. [1] Aviation Cyber Risk Lurks on the Ground, illustrating how compromised devices can be used to move laterally through networks.
The Fuyao operation demonstrates how AI can be weaponized to automate complex fraud. [2] Focus Shifts to Building Smarter AI Systems to detect these types of manipulations before revenue is lost.
Bitsight’s analysis of the botnet led to the discovery of a partner-driven SOC program. [3] 7AI rolls out partner-driven SOC program to combat such threats.
