Threat Actors Use Facebook Ads to Deliver Android Malware

Threat Actors Use Facebook Ads to Deliver Android Malware campaigns, as described by Bitdefender Labs, exploiting Meta’s platform to distribute a sophisticated Android banking trojan masquerading as a free TradingView Premium app. According to Bitdefender Labs, since 22 July 2025 researchers have identified at least 75 Facebook ads promoting the counterfeit app, and by 22 August the ads had reached tens of thousands of users across the European Union.

Desktop users who are not in the targeted Android segment are redirected to innocuous content, while mobile users are directed to a cloned site at new-tw-view[.]online to download an infected .apk. Once installed, the dropper (MD5 788cb1965585f5d7b11a0ca35d3346cc) unpacks a packed APK (58d6ff96c4ca734cd7dfacc235e105bd) that immediately requests extensive permissions, including full accessibility access, with fake “update” prompts masking the request.

The payload is an evolved version of the Brokewell spyware and remote access trojan, featuring crypto theft, 2FA bypass, overlaying fake login screens, surveillance, SMS interception, and remote control via Tor and WebSockets. Bitdefender notes these components are flagged as Android.Trojan.Dropper.AVV and Android.Trojan.Banker.AVM, with Windows components detected as Generic.MSIL[.]WMITask and Generic.JS[.]WMITask.