Cybercriminals Exploit Facebook and Google Ads as Tools for Stealing Sensitive Data

Cybercriminals have expanded a malvertising campaign that began with Facebook Ads selling fake TradingView Premium to infiltrate Google Ads and YouTube, targeting financial platform users worldwide. According to Bitdefender researchers, the campaign now hijacks legitimate ad channels and hijacked YouTube channels to deliver crypto‑stealing malware, exploiting trusted branding to reach broader audiences.

The operation has grown to include over 500 domains and subdomains, with threat actors pushing identical campaigns across multiple platforms and using numerous hijacked or impersonated channels, while several Google accounts were observed aiding the campaign. The malware involved features multi‑stage infection, evasive techniques, and a downloader exceeding 700 MB that includes anti‑sandbox capabilities to defeat analysis.

Communication has evolved to use WebSockets on port 30000 with AES‑CBC obfuscated front‑end scripts, and the final payload, identified as JSCEAL by CheckPoint and WeevilProxy by WehSecure, can intercept all network traffic, harvest cookies and passwords, and perform keylogging and screenshots while persisting on the system.

The campaign has also yielded videos with tens of thousands of views, including an unlisted ad that attracted over 182,000 views in days, underscoring the sophistication and reach of these attacks.