A Deceptive Ad on Facebook Is Spreading Advanced Android Malware

Bitdefender Labs has issued a warning about a global malvertising campaign that uses Meta’s advertising system to push an advanced Android malware, now targeting mobile users worldwide after initially focusing on Windows. According to Bitdefender Labs, the campaign has deployed at least 75 malicious ads since 22 July 2025, reaching tens of thousands of EU users by 22 August.

Victims are redirected to cloned sites such as new-tw-view[.]online, which deliver a malicious APK from tradiwiw[.]online/tw-update.apk; once installed, the app requests dangerous permissions and prompts a fake update while quietly granting itself full access.

The malware delivers far more than credential theft, presenting itself as an evolved version of the Brokewell spyware and remote access trojan, capable of crypto theft, 2FA bypass, overlaying fake login screens, keylogging, screen recording, cookie theft, live location, microphone and camera access, and SMS interception, with remote control over attacker servers via Tor and WebSockets.

Attackers have impersonated dozens of brands, including Binance, Bitso, EToro, Ledger, Nexo, Revolut, and even Donald Trump, with regional tailoring seen in Latin America and Thailand.