Many people believe that smartphones are somehow less of a target for threat actors.

Meta Malvertising Campaign Spreads Android Crypto-Stealing Malware

A sophisticated malvertising campaign targeting Meta’s ad network has expanded from Windows to Android users worldwide, deploying an advanced version of the Brokewell malware disguised as TradingView’s premium app[1].

Since July 22, 2025, cybercriminals have launched over 75 malicious Facebook ads, reaching tens of thousands of users across the European Union[1:1]. The campaign tricks victims into downloading a malicious APK from fake domains that mimic TradingView’s official website.

The malware, an enhanced strain of Brokewell, functions as both spyware and a remote access trojan (RAT) with capabilities including:

  • Cryptocurrency theft (BTC, ETH, USDT)
  • SMS interception for banking and 2FA codes
  • Google Authenticator data extraction
  • Screen recording and keylogging
  • Camera and microphone activation
  • Remote command execution via Tor and WebSockets[1:2]

The attackers have localized their ads in multiple languages including Vietnamese, Portuguese, Spanish, Turkish, Thai, Arabic and Chinese to maximize reach[1:3]. While the Android campaign currently focuses on impersonating TradingView, the Windows version has mimicked numerous brands including Binance, Bitget, Metatrader, and OKX[1:4].

  1. Bitdefender - Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

        • chicken@lemmy.dbzer0.com
          2·
          12 days ago

          That’s just the remote control part.

          promises of a free TradingView Premium app for Android. Instead of delivering legitimate software, the ads drop a highly advanced crypto-stealing trojan — an evolved version of the Brokewell malware.

          From another source, that works in part by exploiting “accessibility service permissions”:

          Like other recent Android malware families of its kind, Brokewell is capable of getting around restrictions imposed by Google that prevent sideloaded apps from requesting accessibility service permissions.

          …

          This includes displaying overlay screens on top of targeted apps to pilfer user credentials. It can also steal cookies by launching a WebView and loading the legitimate website, after which the session cookies are intercepted and transmitted to an actor-controlled server.

            • chicken@lemmy.dbzer0.com
              2·
              12 days ago

              It would maybe be safer on a custom OS because less malware would target it, but exploits can still exist, at this point I’d say you also should really be using a dedicated device for crypto wallet stuff if you have more than small amounts, whether that’s a purpose built hardware wallet, an old phone you reset and have only the wallet app on, etc.