from Zerush@lemmy.ml to privacy@lemmy.ml on 02 Sep 13:38
https://lemmy.ml/post/35572248
Meta Malvertising Campaign Spreads Android Crypto-Stealing Malware
A sophisticated malvertising campaign targeting Meta’s ad network has expanded from Windows to Android users worldwide, deploying an advanced version of the Brokewell malware disguised as TradingView’s premium app[^1].
Since July 22, 2025, cybercriminals have launched over 75 malicious Facebook ads, reaching tens of thousands of users across the European Union[^1]. The campaign tricks victims into downloading a malicious APK from fake domains that mimic TradingView’s official website.
The malware, an enhanced strain of Brokewell, functions as both spyware and a remote access trojan (RAT) with capabilities including:
- Cryptocurrency theft (BTC, ETH, USDT)
- SMS interception for banking and 2FA codes
- Google Authenticator data extraction
- Screen recording and keylogging
- Camera and microphone activation
- Remote command execution via Tor and WebSockets[^1]
The attackers have localized their ads in multiple languages including Vietnamese, Portuguese, Spanish, Turkish, Thai, Arabic and Chinese to maximize reach[^1]. While the Android campaign currently focuses on impersonating TradingView, the Windows version has mimicked numerous brands including Binance, Bitget, Metatrader, and OKX[^1].
threaded - newest
WTF is dis
Tor is basically a way to connect to the internet anonymously.
WebSockets is basically a way for P2P connections between servers and clients.
I got that but how does this exploit work?
Threat actor using tor to exploit open websockets?
That’s just the remote control part.
From another source, that works in part by exploiting “accessibility service permissions”:
WTF, this is sounds like what graphenseOS was design to avoid...
It would maybe be safer on a custom OS because less malware would target it, but exploits can still exist, at this point I’d say you also should really be using a dedicated device for crypto wallet stuff if you have more than small amounts, whether that’s a purpose built hardware wallet, an old phone you reset and have only the wallet app on, etc.
Gee, if only there was an alternative to Meta’s stinky apps…some kind of decentralized, federated network of servers and users that’s funded by the community instead of ads and user data sales…
Ah, well. We can only dream. /s
Yes, would be nice, the problem is the family and friends which are using Fakebook, Whatscrap and other and you in their contact list, than you are also in the Zuckerbot To Do list, irrelevant if you’ve an account or not. Than you can’t do other as block completly Facebook from your internet as I do.
uBo.
Minimum, better using Portmaster and block anything from Fakebook in both directions, but than also you can’t access, avoiding to click accidentaly on a link, irrelevant of which from it’s apps or services
<img alt="" src="https://lemmy.ml/pictrs/image/db2b005f-b89c-4762-891f-918822083e7d.png">
This cause
<img alt="" src="https://lemmy.ml/pictrs/image/7613f326-4d44-4adf-8e06-baa93c945dc5.png">
Can’t I still use it to talk to my mom on messenger with video calls if I do that ?
No, at least if you don’t desactivate the filter before. Better to convince your mother to use another app.
And they wonder why people block ads.