FunFoneFarm and the Off-the-Shelf Scam Economy

The hardware at the heart of the modern phone farm is not limited to sales on the dark web, it’s listed openly on mainstream marketplaces. Listings give would-be threat actors options for device size, model, and tech specs.

What these boxes actually provide is fairly mundane: they are, in effect, glorified USB hubs. The product being sold is not intelligent, it is simply rack space for phone orchestration: a way to house, power, and connect a large number of devices so that a single operator can manage them at once. The value to a threat actor is in the convenience, not in any novel technology.

Because the boxes are essentially just USB hubs, their configuration is fairly straightforward: power, USB connection to the controller, and an ethernet connection:

Notice that the phones in the rack appear just to be circuit boards slotted in. That’s essentially what they are, and that’s all they need to be: a piece of hardware that can operate the software needed to present as a phone.

There is nothing in the rack that a threat actor needs to engineer. The components within are commodity parts, they’re assembled in a predictable pattern, and the whole kit is shipped ready-to-use, making the barrier to acquiring the physical infrastructure little more than the cost of acquisition.

The hardware alone is inert; what turns a rack of phones into a productive fleet is the orchestration software that controls every device in concert. Here, too, the tooling is readily available. There are several options for management software openly available, and the vendors behind them present themselves less like illicit operators and more like legitimate software businesses, offering polished, professional documentation and customer support for all of an operator’s automation needs.

Within that orchestration layer, one tool stands out as the de facto standard for automating the individual devices: Auto.js. Auto.js’ appeal is that it operates the way a person does. The framework uses an Android API to learn everything that’s on the screen—every button, text field, and image—and simulate interactions such as clicks, swipes, and text entry, and monitor for events like an app opening or a notification arriving.

What this means is a threat actor can write a simple script (for example, “find the button labeled [x] and click on it”), and Auto.js carries out the action.

Notably, Auto.js is well suited to driving native mobile apps, but the open web is a different problem. A browser renders pages in ways Auto.js can’t easily read and act on. That matters because a great deal of the actual scam activity, like the funnels to trading platforms, the web-based social and dating surfaces, happens in exactly that browser environment. Would-be fraudsters have to turn to separate tools for mobile browser automation.

The final piece of the farm story is the one that most clearly accelerates the commoditization of this threat. The AI integration of the automation tool is not an autonomous agent running the farm. It is, more accurately, using AI to help users write and test their scripts.

The handsets observed and acquired by the researchers were neither new nor high-end. They’re older devices (often several product generations out of date), selected precisely because they’re among the cheapest options on the market. For an operator, performance matters less than price and availability; a device only needs to be capable of running the target apps and cheap enough to buy in bulk.

It’s simpler and easier for threat actors to forgo intact phones altogether and instead use bare phone motherboards, as seen in the above screenshots. These boards are sourced cheaply from the secondary market, often salvaged from recovered or broken devices, bought wholesale, or acquired as factory rejects. The result is a stripped-down, industrialized device whose only purpose is to run automation at the lowest possible cost per unit.

A reasonable question is how to spot whether a given device is part of a farm rather than a phone in an ordinary person’s pocket. We are deliberately circumspect here: several reliable indicators are also spoofable by threat actors, but some indicators are worth describing because they illustrate how these devices are built and operated.

Researchers examined “helper” applications that betray their purpose. One, a device-management helper, launches a screen-mirroring utility whenever something is connected over USB:

This capability allows a farm operator to monitor all of the screens in the farm at once, as they’re all connected to USB (as seen in the above photos of phone motherboards).

The second, an automation helper, performs automated scrolling, executing the bottom-to-top swipe gesture that is the standard motion for navigating short-form video platforms. Notably, rather than moving in straight lines (which are more easily spotted by basic anti-bot technology), this helper generates curved swipe paths and randomizes both the timing and the start and end points of each gesture in an effort to make machine-driven scrolling resemble the natural variability of a human thumb.

Screen-size characteristics offer another, lower-stakes signal. Differences in reported screen dimensions can help distinguish farm devices—particularly stripped-down or non-standard configurations—from the consumer handsets they are meant to imitate.

For an operator unwilling to buy, configure, and maintain physical hardware, there is an even simpler path: rent the phones. Cloud-phone services host virtual Android devices that an operator can control remotely, removing the last hardware barrier and reducing farm operation to a software subscription.

These services are packaged for a broad, mainstream audience. One prominent provider, VMOS, offers tiered pricing plans aimed at everyday users rather than a technical underground. Making a cloud phone behave like a real one requires some scaffolding: the platform supplies custom applications, including its own app store, to bridge ordinary phone functionality into the virtual device.

Crucially, the cloud phone is also malleable in ways a physical device is not. An operator can change the device’s model and other identifiers on demand, reshaping how the virtual phone presents itself to the outside world.

The veneer of legitimacy extends to the infrastructure beneath these consumer brands. The phone cloud offering offers extensive, professional documentation.

The same qualities that make these platforms attractive to legitimate customers make them equally convenient for a threat actor.

Finally, providers of cloud phone services offer multiple privacy-centric options and guides. One provider offers residential proxy services at the time of setup, which can help a threat actor mask the origin of their activity:

The same cloud phone provider links to an anti-detection browser, a web browser that attempts to hide details associated with the browser, which can enable a threat actor to operate multiple accounts when a platform might otherwise flag those as being automated:

Above, several examples of dating apps used by threat actors to carry out the early stages of many fraud schemes. These apps are themselves perfectly safe and legitimate, but threat actors abuse the direct-messaging feature to coerce victims into various scams, including pig-butchering, remote work scams, and paid upgrades for enhanced “access” to the threat actors’ profiles.

To see inside the scams firsthand, researchers set up a handful of profiles using a fake photo and an intentionally uninteresting bio. The profiles nonetheless drew heavy engagement, an early signal that much of the attention was automated.

Malicious accounts like these share an opening move: get the target off the platform. The first step of the script is almost always to pull the conversation into messaging-specific apps, beyond the reach of the dating app’s own protections. Over several days of testing, researchers were steered toward several adult-content subscriptions and one full pig-butchering pitch.

Alongside the one-to-one operations described above, the same phone farm infrastructure enables OnlyFans Management, or OFM, which we will describe as adult-content account marketing. At its core, adult-content account marketing is the business of managing, marketing, and growing creators’ accounts—both real and fake—on subscription platforms. Threat actors use AI tools and social-media marketing strategies to funnel traffic from mainstream social networks to the subscription platform, where they nurture subscribers through escalating monetization tiers. Although the term originates with a specific platform, the same playbook applies to social-media marketing more broadly.

A typical threat actor’s operation:

• Creates a “model” (often targeting a specific niche) with content generated by AI or sourced from real people.
• Maintains engagement through a mix of human “chatters” and AI bots.
• Escalates subscribers along a monetization ladder (free → cheap → expensive → high-ticket), mirrored by a content ladder (cold → teasing → hot → explicit).

The farms and phones are, in part, an account-manufacturing operation for exactly this kind of marketing, allowing threat actors to conduct these operations at scale without the need for a large team to operate it.

Perhaps the most striking feature of this ecosystem is how little of it is hidden. The account supply chain is marketed in plain sight through video tutorials, sellers on mainstream social platforms, and open-source farm platforms hosted on public code repositories.

A recurring service in this market is account “warm-up”: the practice of gradually aging and building activity on an account so that it accrues the history and credibility needed to pass a platform’s trust checks before being deployed at scale. Warm-up is a critical element to the success of these scams, ensuring that accounts created during the account-manufacturing described above are effective for the scams that consume those accounts.