TradingView Impersonation Ads Spread Stealer Malware Through Google and YouTube
Summary
Bitdefender researchers detail a campaign using hijacked Google and YouTube accounts and TradingView-themed ads to deliver malware. The infection chain leads to a stealer with credential theft, keylogging, and remote-access capabilities.
Key points
- The campaign expanded from Meta to Google Ads and YouTube, using hijacked accounts and TradingView branding to promote malicious downloads.
- Attackers used unlisted ad videos and phishing pages to direct targeted users to malware, while some visitors could receive benign pages.
- The custom-built downloader is over 700 MB and uses anti-sandbox checks; its communications use websockets on port 30000 and the /config route.
- The installer creates a scheduled task, adds Windows Defender exclusions, and uses PowerShell to download and execute the next stage.
- The final payload, called JSCEAL by Check Point and WeevilProxy by WithSecure, can steal credentials and cryptocurrency wallet data, log keystrokes, take screenshots, and proxy network traffic.
- Bitdefender reports more than 500 associated domains and subdomains, multiple hijacked or impersonated channels, and emerging macOS and Android samples.
- Users are advised to download software only from official sites; creators and businesses are urged to enable MFA and review account recovery options and channel permissions.
Article Details
- Attack Vectors
- Malicious ads on Google Ads and YouTube impersonated TradingView and promoted unlisted videos linking to malware downloads.
- The attackers used hijacked Google advertiser and YouTube accounts to lend credibility to the ads and channel.
- The article describes phishing emails, malicious attachments, and credential-stealing campaigns as possible ways attackers obtain access to business Google accounts.
- The malware used an oversized downloader and checks for virtualized or sandboxed environments to resist analysis.
- The installer created a scheduled task, added Windows Defender exclusions, and used PowerShell to download and execute the next stage.
- Defensive Notes
- Check channel handles and subscriber counts, and be wary of unlisted ad-only videos.
- Download software only from official websites and report suspicious ads to YouTube or Google Ads.
- Enable multi-factor authentication, review account recovery options, audit channel roles and permissions, and monitor for unusual account activity.
- Use security solutions to block malicious links and malware.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe installer creates a Windows Scheduled Task named EdgeResourcesInstallerV12-issg for persistence.T1056.001 · KeyloggingThe final payload is reported to include keylogging.T1059.001 · PowerShellThe malware uses the Invoke-Expression PowerShell cmdlet to execute the next stage.T1113 · Screen CaptureThe final payload is reported to take screenshots.T1497.001 · System ChecksThe downloader checks for virtualized or sandboxed environments to resist analysis.T1562.001 · Disable or Modify ToolsThe malware adds Windows Defender exclusions.
People
Malware
Android.Trojan.Banker.AVMEmerging macOS and Android samples designed to extend the attack beyond Windows (which are detected as Variant.MAC.Amos.9 and Android.Trojan.Dropper.AVV & Android.Trojan.Banker.AVM);Android.Trojan.Dropper.AVVEmerging macOS and Android samples designed to extend the attack beyond Windows (which are detected as Variant.MAC.Amos.9 and Android.Trojan.Dropper.AVV & Android.Trojan.Banker.AVM);Generic.MSIL.WMITaskresearchers identified that, while it shares traits with past samples (such as those detected as Generic.MSIL.WMITask), the initial downloader was custom-built to resist detection and analysis.JSCEALwith various detections and the final payload as Trojan.Agent.GOSL. The malware (final payload), named JSCEAL by Checkpoint and WeevilProxy by WithSecure, is a sophisticated stealer with both espionage and remoteTrojan.Agent.GOSLthe intermediate powershells with various detections and the final payload as Trojan.Agent.GOSL. The malware (final payload), named JSCEAL by Checkpoint and WeevilProxy by WithSecure, is aVariant.DenoSnoop.Marte.1Bitdefender detects the initial loader as Variant.DenoSnoop.Marte.1, the intermediate powershells with various detections and the final payload as Trojan.Agent.GOSL. The malware (final payload), named JSCEAL byVariant.MAC.Amos.9Emerging macOS and Android samples designed to extend the attack beyond Windows (which are detected as Variant.MAC.Amos.9 and Android.Trojan.Dropper.AVV & Android.Trojan.Banker.AVM);WeevilProxythe final payload as Trojan.Agent.GOSL. The malware (final payload), named JSCEAL by Checkpoint and WeevilProxy by WithSecure, is a sophisticated stealer with both espionage and remote access capabilities.
Vendors
BitdefenderOver the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financialGoogleThe Scam That Won’t Quit: Malicious “TradingView Premium” Ads Jump from Meta to Google and YouTubeMicrosoftPostHog for user tracking, while also using Facebook Pixel tracking, Google Ads Conversion Tracking, Microsoft Ads Pixel and Adprofex postback. These tracking efforts, obviously without user consent, offer a clear
Products
FacebookBitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms.Google AdsAccording to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks.PowerShelladds Windows Defender exclusions and downloads and executes the next stage using the Invoke-Expression powershell cmdlet. The whole malicious process can be seen below in a simplified form.TradingViewThe Scam That Won’t Quit: Malicious “TradingView Premium” Ads Jump from Meta to Google and YouTubeWindows DefenderThrough these scheduled tasks, the malware adds Windows Defender exclusions and downloads and executes the next stage using the Invoke-Expression powershell cmdlet. The whole malicious process can be seen below in aYouTubeThe Scam That Won’t Quit: Malicious “TradingView Premium” Ads Jump from Meta to Google and YouTube