Read This Before You Buy That TV Streaming Stick

Krebs on Security reports that cheap TV streaming sticks widely sold on Amazon and Best Buy are running malware that performs ad fraud on a massive scale. Security researcher Pedro Falé discovered these devices, marketed as unlimited streaming solutions, secretly masquerade as mobile phones and click ads on artificially-generated websites controlled by a China-based operation. The malware spoofs legitimate phone identities from Samsung, Xiaomi, and others, then directs the devices to fake news and entertainment sites where it automatically clicks ads for profit. Investigators found the fraud scheme was built using simplified drag-and-drop coding tools, making it easy for operators without technical expertise to scale the operation. Bitsight estimates the network operates roughly 38,000 of these compromised devices globally, generating close to fifty thousand dollars a day in fraudulent clicks—and that's not counting the separate scheme where these same boxes rent out users' home internet connections. Despite repeated FBI warnings, retailers continue selling hundreds of models with minimal security protections.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton