Phone Farms - How automation amplifies and fuels global cybercrimes

The article is about a phone farm (手机盒子 / 群控系统) marketed as “Polestar Host” with proprietary management software. The infrastructure is designed for large-scale automation of 20+ physical Android devices from a single PC console.

In Chinese gray-market terminology, this is a qunkong (群控), group-control solution optimized for evasion of mobile risk controls (风控).

Primary criminal utility is yanghao (养号), mass account farming, inauthentic engagement, and bypass of telecom-based identity verification.

1. Infrastructure Overview

1.1 Hardware / Software Architecture

• Host: 20-slot chassis (observed labeling A1–A20 / 01–20) with integrated power, networking, and USB aggregation. Marketed as wholesale hardware for “phone farm setup, easily control your phone on computer integrated farm.”
• OS: Lightweight customized Android 13 AOSP (轻量化系统) with kernel-level root pre-integrated.
• Control Plane: Windows-based client (Polestar Cloud Control). Observed top-level menu: Phone Connect, Phone Command, App Management, File Sync, Mouse Sync, Keyboard Sync, Script Market, Advanced Features, Settings. Chinese UI equivalent: 设备连接, 手机指令, 应用管理, 文件传输, 同步鼠标, 同步键盘, 脚本市场, 高级功能.

This follows the known evolution of cloud-phone group control systems: operational commands are sent from the server/host to the mobile nodes. By injecting content and simulating manual operations at a low level, the system attempts to avoid app-level monitoring mechanisms.

1.2 Observed Device Fleet

Concurrent mirrored screens and an identical app dock containing TikTok, Facebook, YouTube, etc. can be run on the fleet. This provides.

• Time synchronization or batch provisioning
• Pre-installed social-media stack optimized for farm operations

2. Component Analysis

2.1 Virtual SIM & Cellular Spoofing

Virtual SIM (虚拟SIM) and simulated baseband is supported:

• Network: Advantage (MVNO commonly used for US virtual numbers / OTP reception platforms, 接码平台)
• Phone number on SIM: example +1-830-680-0793
• Mobile network state: Connected
• Service state: In Service
• Signal strength: –107 dBm / 33 asu (synthetic value typical of baseband emulation, not real RF)
• Mobile voice/data network type: LTE
• Roaming: Not Roaming

This functions as a software-based SIM-box / SIM-farm variant. ICCID, IMSI, MCC, MNC, and phone number are injected at the OS / RIL / framework layer so that apps (especially TikTok trust-scoring logic) see plausible subscriber identity without a physical SIM.

2.2 Evasion Stack, Chinese Detection Bypass

The core value proposition. The marketing comparison lists 17 evasion features. Relevant Chinese detection frameworks include:

• MOMO, comprehensive root / ROM / environment detector (filesystem, mounts, SELinux, Zygisk, Magisk artifacts, etc.)
• Hunter (com.zhenxi.hunter and related), focuses on Magisk/root, sandbox, Frida/IDA, and hooking frameworks
• Bull Head / Niu Tou (小黑盒), risk scanner used by games and fintech to detect emulators and custom environments

Claimed bypasses include:

1. No USB Debugging Required, avoids classic adb / ro.debuggable / Settings.Global.ADB_ENABLED flags that traditional group-control software triggers.
2. No Ethernet Debugging Detection, presents the network as mobile data (Wi-Fi or simulated 4G) instead of an eth0 interface.
3. Google Play Integrity Passed, aims for a clean MEETS_DEVICE_INTEGRITY (or higher) verdict so that WhatsApp, banking apps, and similar services will run.
4. Built-in KernelSU, kernel-level root versus Magisk’s userspace approach, making root harder for userspace detectors to observe.
5. Bypass Bootloader Lock Detection, spoofs ro.bootloader, verified-boot, and related properties.
6. Common Risk Detection Bypass (通用风控), generic anti-fraud SDK fingerprint randomization and correlation breaking.

2.3 Proxy & Automation

• Invisible S5 Proxy Support (S5代理): System-level SOCKS5 injection without app awareness (avoids VPNService / HTTP_PROXY traces). UI panels for “Build Proxy” and “Proxy Route.”
• RPA Framework Support: UIAutomator / Appium-style automation via Script Market. Enables scripted posting, liking, following, and interaction.
• App data backup/restore: Supports cloning account states across devices for one-click 养号 transfer.

3. Architecture at a High Level

Typical setup:

Host Controller (x86 Windows/Linux) → Backplane (power + network) → 20–60 Android Compute Nodes (real ARM SoCs)

Each node is a physical ARM SoC running a modified AOSP Android 13 image, not an emulator. Control is out-of-band: the host injects input events directly into the input subsystem and captures the framebuffer (via SurfaceFlinger / hardware composer or equivalent) rather than using adbd. Consequently ro.debuggable, sys.usb.config, and the ADB daemon are never started, so apps do not see the classic debugging flags.

The node OS typically includes:

• GApps / Play Services kept intact where possible
• Kernel with KernelSU built-in
• System-level hooks for telephony, connectivity, and transparent proxy
• Proprietary group-control agent

4. Capabilities Breakdown

A. No USB Debugging / No Ethernet Debugging Detection

Traditional tools (Total Control, STF, older boxes) rely on ADB over USB or ADB-over-Ethernet (RNDIS). Apps detect these via Settings.Global.ADB_ENABLED, init.svc.adbd, UsbManager Ethernet interfaces, or ConnectivityManager reporting TRANSPORT_ETHERNET. Polestar’s control plane is designed to look like ordinary user input on a Wi-Fi/4G device.

B. Google Play Integrity Passed

Play Integrity evaluates device genuineness, basic integrity, and (for the strongest verdict) hardware-backed attestation of a locked bootloader. Achieving a usable pass on a multi-board farm requires real hardware, appearance of a locked/verified boot state, minimization of userspace modifications, and careful handling of the attestation path. This remains an arms-race item under continuous Google pressure.

C. Built-in KernelSU (Kernel-Level Root)

Unlike Magisk (which lives largely in userspace and leaves mounts, binaries, and SELinux traces), KernelSU embeds privilege decisions in the kernel (typically intercepting relevant system calls). Root can be granted selectively to the automation agent while remaining hidden from third-party apps. Combined with techniques such as SUSFS-style per-app mount namespaces, many of the artifacts that MOMO flags can be removed from the view of target processes.

D. Network Identity Virtualization

• Virtual SIM: Framework / RIL hooks return synthetic but valid-looking ICCID, IMSI, MCC/MNC, and line number.
• Simulated LTE: Forces network capabilities and TelephonyManager to report cellular transport and LTE data network type, reducing pure-Wi-Fi correlation.
• Invisible S5 Proxy: Transparent redirection (netfilter / kernel-level) so applications see a normal cellular-looking connection without VPNService or proxy-property traces. Each node can exit via a different residential IP.

E. Environment Detection Bypass Suite

MOMO checks a large set of Magisk/Zygisk/mount/SELinux/property indicators. Hunter focuses on Xposed/LSPosed/Frida-style hooking. Bull Head and bootloader checks examine verified-boot state and related properties. Polestar’s combination of KernelSU + selective hiding + property/network/SIM normalization is intended to eliminate the majority of positive signals these tools look for. Passing community detectors is not the same as defeating production commercial risk engines.

F. Android 13 Support

Modern permission models, stricter serial/Build restrictions, full Play Integrity migration, and kernels (5.10/5.15+) required for current KernelSU and contemporary apps (WhatsApp, etc.).

G. RPA / Automation Framework Support

System-level agent with event-injection capability (UIAutomator-style or equivalent) plus a host-side group API that can broadcast actions across all nodes in parallel. Input is injected at the InputDispatcher level rather than via slow, detectable ADB input commands.

5. Criminal Application Model

Summary

Polestar Host is a dense multi-SoC Android platform whose engineering goal is to make each node appear as a normal, retail, cellular Android 13 device while remaining fully controllable at industrial scale. KernelSU relocates privilege and hiding, framework/RIL modifications fabricate telephony identity, transparent proxying and network-type spoofing remove connectivity fingerprints, a custom out-of-band control plane avoids classic ADB/Ethernet indicators, and continuous system updates attempt to keep pace with detector evolution.