Fuyao Enterprise Building an Ad-Fraud Empire with AI and Kid...

src/mobile-pentesting/android-app-pentesting/README.md

@@ -106,6 +106,29 @@ abusing-android-media-pipelines-image-parsers.md
 firmware-level-zygote-backdoor-libandroid_runtime.md
 {{#endref}}
 
+### Pre-installed privileged Android TV-box implants (OEM / reseller firmware abuse)
+
+Some Android botnets are not sideloaded by the victim: they are baked into OEM/reseller firmware as privileged packages and later extend themselves with secondary APKs outside the normal user install flow. Treat these samples as a **firmware/supply-chain foothold** instead of as a normal malicious app: they can keep persistent C2 channels, install follow-on modules, stream the display, and repurpose the device for fraud or residential proxying.<sup>[[17]](#references)</sup>
+
+When reversing pre-installed Android implants, prioritize the following checks.<sup>[[17]](#references)</sup>
+
+- **Package origin / privilege mismatch**: compare `codePath`, shared UID, requested permissions, and install paths against stock firmware. APKs that live outside `/data/app`, cannot be removed normally, or reappear across unrelated brands/models are strong supply-chain indicators.
+- **Trusted follow-on install paths**: inspect locations such as `/data/local/system` for dynamically dropped APKs/JARs used as task modules or alternate execution modes.
+- **Cross-layer identity spoofing**: do not trust only `getprop` or only browser fingerprints. Reconcile system properties, screen size, chipset remnants like `rockchip`, `amlogic`, or `allwinner`, launcher/settings packages, and browser-visible CPU/GPU data to catch TV-box-to-phone masquerading.
+- **Selector-independent UI automation**: if the sample combines `AccessibilityService` abuse with OCR/object-detection assets, assume the operator can survive DOM/UI churn. Inspect `assets/` for ML models, OCR libraries, browser stealth scripts, and generated JavaScript task modules instead of focusing only on selectors.
+- **Proxy-only monetization mode**: hunt for bootstrap endpoints that fetch backconnect servers, then long-lived tunnels carrying multiplexed SOCKS5 sessions over a custom framing layer. This is closer to a residential proxy backhaul than a simple local SOCKS listener; see [Tunneling and Port Forwarding](../../generic-hacking/tunneling-and-port-forwarding.md).
+- **Expired management infrastructure**: extract hardcoded domains/IPs from privileged apps and management agents, then verify whether DNS/TLS ownership still matches the vendor. If a root-capable management domain has expired, the finding becomes a mass-device takeover opportunity rather than a mere dangling record; see [Domain/Subdomain takeover](../../pentesting-web/domain-subdomain-takeover.md).
+
+A quick rooted-device triage for this pattern is:<sup>[[17]](#references)</sup>
+
+```bash
+adb shell pm list packages -f
+adb shell dumpsys package <package>
+adb shell find /data/local/system -maxdepth 2 -type f 2>/dev/null
+adb shell getprop | grep -E 'ro.product|ro.board|ro.hardware|ro.build'
+adb shell dumpsys accessibility
+```
+
 ## Static Analysis
 
 First of all, for analysing an APK you should **take a look to the to the Java code** using a decompiler.\
@@ -960,6 +983,7 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [14] [justapk — multi-source APK downloader with Cloudflare bypass](https://github.com/TheQmaks/justapk)
 - [15] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
 - [16] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
+- [17] [Fuyao Enterprise: Building an Ad-Fraud Empire with AI and Kids' Coding Blocks](https://bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks)
 
 
 {{#include ../../banners/hacktricks-training.md}}