Crooks exploit Meta malvertising to target Android users with Brokewell

Crooks are exploiting Meta malvertising to distribute Brokewell to Android users, with Bitdefender reporting a campaign that lakes the TradingView Premium brand to lure targets with fake Android apps. Since 22 July, at least 75 malicious ads have directed users to download a trojanised .apk from cloned sites, after which the app requests accessibility permissions, hides behind fake update prompts and prompts for lock screen PINs.

The Brokewell Trojan then activates as a full spyware and remote access tool, capable of monitoring, controlling and stealing data, including crypto wallets, and it communicates with command-and-control servers via Tor and WebSocket. Its feature set includes clipboard and email scraping, keylogging, camera and microphone access, geolocation tracking, SMS and call control, and even remote execution, with advanced operations such as VNC streaming and overlay injection.

According to Bitdefender, the malware uses obfuscation, native libraries and reflection to hide code, and it targets EU users at scale; experts advise installing apps only from official stores and to scrutinise URLs and permissions.