Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide

Many people believe that smartphones are somehow less of a target for threat actors. They couldn’t be more wrong.

Bitdefender Labs warns that cybercriminals are doubling down on spreading malware through Meta’s advertising system. After months of targeting Windows desktop users with fake ads for trading and cryptocurrency platforms, hackers are now shifting towards Android users worldwide.

Bitdefender researchers recently uncovered a wave of malicious ads on Facebook that lure targets with promises of a free TradingView Premium app for Android. Instead of delivering legitimate software, the ads drop a highly advanced crypto-stealing trojan — an evolved version of the Brokewell malware.

This campaign shows how cybercriminals are fine-tuning their tactics to keep up with user behavior. By targeting mobile users and disguising malware as trusted trading tools, attackers hope to cash in on the growing reliance on crypto apps and financial platforms.

Inside the Malicious Ad Campaign Targeting Android Users

According to our most recent analysis, the malware campaign (which is still active) made use of at least 75 malicious ads since 22 July 2025. By August 22, the ads have reached tens of thousands of users in the EU alone.

The ads used TradingView’s branding and visuals to trick people into downloading the free premium app onto their devices.

We’ve even spotted a variation of the ad pairing the TradingView branding with an image of a Labubu.

Note: If a desktop user, who does not fall in the targeted group, clicks on the ad, random, benign content will be delivered instead.

However, Android users who followed the link are redirected to a cloned webpage that mimics the official TradingView site (new-tw-view[.]online), where they unknowingly downloaded a malicious .apk file from tradiwiw[.]online/tw-update.apk.

The file has the MD5 checksum 788cb1965585f5d7b11a0ca35d3346cc, and it drops the packed APK 58d6ff96c4ca734cd7dfacc235e105bd.

Once installed, the app immediately begins requesting powerful permissions such as accessibility access — all while hiding behind fake update prompts.

The dropped application asks for accessibility, and after receiving it, the screen is covered with a fake update prompt. In the background, the application is giving itself all the permissions it needs.

The application also tries to trick the user into giving their lock screen PIN:

The application chooses to overlay over some installed apps, such as YouTube, where a WebView and a Toast message is displayed, prompting the user to download the Venmo app:

The initial application decrypts from its resources the dropped application and starts it by prompting the user to give it accessibility permissions, since the dropped app does not have a launcher. If the user grants these permissions, the dropper is uninstalled to cover its tracks.

By decrypting the strings used in the classes, we find permissions requests in multiple languages available, such as English, Spanish, Portuguese, German, French, Italian, Turkish, Finnish, etc.

Once installed, the malware reveals itself as far more than a simple credential stealer. It’s an advanced version of the Brokewell malware, a full-fledged spyware and remote access trojan (RAT) with a vast arsenal of tools designed to monitor, control, and steal sensitive information from the victim’s device.

Its capabilities include:

• Crypto theft – Scanning for BTC, ETH, USDT, IBANs, and more.
• 2FA bypass – Scraping and exporting codes from Google Authenticator.
• Account takeover – Providing the possibility to overlay fake login screens
• Surveillance – Recording screens, keylogging, stealing cookies, activating the camera and microphone, and tracking live location.
• SMS interception – Hijacking the default SMS app to intercept messages, including banking and 2FA codes.
• Remote control – Communicating with attackers over Tor and WebSockets, with commands to send SMS, place calls, uninstall apps, or even self-destruct.

In short, this is one of the most advanced Android threats seen in a malvertising campaign to date.

The app is obfuscated and uses two native libraries to retrieve what methods to execute and the parameters to call them with. It also contains methods to search for regexes of crypto wallets such as:

The dropped application contains 2 raw files which are used as:

–          A configuration file that is loaded as a JSON and which contains what websites to use for overlaying installed apps on the device.

–          The other one is a .dex file stored as a raw resource file, which is decrypted using a key from the native library and its classes are loaded using reflection.  This is where most of the malicious code is hidden.

The application connects to a Tor server and a WSS one for C2C communication and logging.

Extended supported commands:

IOCs analyzed dropper samples downloaded from the Facebook ads:

IOCs analyzed dropped samples:

A Global, Multi-Language Scam

This Android wave is just one branch of a much larger malvertising operation abusing Facebook Ads that initially began targeting Windows desktops. Over time, the cybercriminals behind the campaign have impersonated dozens of well-known brands, people, and cryptocurrencies, including:

• TradingView, Binance, Bitget, Bitso, Blackbull and Bybit
• Chatbox, EToro, Exness and Grass (https://www.grass.io/)
• Facebook and  Telegram
• FTMO, HTX, Hyper and GMGN
• LBank, Ledger, Lemon.me and Line
• Metatrader, Monad, Monero, Nexo and Pi Network
• OKX, Remitano and Revolut
• United States President Donald Trump

To maximize reach, the ads were localized in multiple languages — Vietnamese, Portuguese, Spanish, Turkish, Thai, Arabic, Chinese, and more.

In some cases, threat actors aligned brand lures with regional popularity, such as:

• Lemon.me in Latin America
• Exness and Orbix in Thailand
• Blackbull in Asia-Pacific

We have also observed examples in French, Bulgarian, Romanian and other languages.

This level of adaptation makes the campaign harder to spot and more convincing to its targets.

While the campaign targeting Windows users is ever-growing, at the time of writing, we’ve  only found ads impersonating the Tradingview brand that are targeting Android users. Given past evolutions, we expect the number of ads and impersonated brands to increase. Interestingly, when accessing malicious domains specific to Windows from an iOS device, familiar content is shown, but it is also mentioned that the system is unsupported.

On Android, when accessing links specific to the Windows operating system, the displayed content is random and not tied to malicious advertisements in any way. The same happens with MacOS systems.

This expansion signals an alarming trend: mobile users are no longer safe from malvertising campaigns that once primarily targeted desktops. The combination of brand impersonation, localized ads, and sophisticated malware capabilities makes this campaign especially dangerous.

With the rise of mobile banking, crypto wallets, and 2FA apps on smartphones, the stakes are higher than ever. A single compromised Android device can hand over access to a victim’s finances, personal communications, and sensitive accounts.

Bitdefender detections for the campaign:

• Malware targeting Windows users are detected as Generic.MSIL.WMITask (MSI dropper) and Generic.JS.WMITask (front-end scripts)
• Android malware is currently detected as Android.Trojan.Dropper.AVV (dropper) and Android.Trojan.Banker.AVM (dropped malware).

How to Stay Safe

• Avoid sideloading apps – Only install apps from official stores like Google Play.
• Be wary of ads – Even on trusted platforms like Facebook, cybercriminals ca abuse ads.
• Check URLs carefully – Fake download pages often use lookalike domains.
• Review app permissions – If an app requests accessibility access or lock screen PINs without a clear reason, it’s a red flag.
• Use free scam detection tools from Bitdefender – Have a chat with Scamio (our AI-powered scam detector chatbot) or scan a suspicious link through Bitdefender Link Checker.
• Use a trusted security solution – Bitdefender Mobile Security for Android detects and blocks threats like Android.Trojan.Dropper.AVV and Android.Trojan.Banker.AVM before they can compromise your device.