Facebook Ads Spread Brokewell Android RAT Disguised as TradingView App

Aug 26, 2025 · Original article ↗

Summary

Bitdefender reports an active Facebook malvertising campaign that uses fake TradingView Android ads to deliver a Brokewell-based RAT capable of stealing crypto and credentials, intercepting SMS, and remotely controlling infected devices.

Key points

Researchers found at least 75 malicious ads since July 22, 2025; by August 22, they had reached tens of thousands of users in the EU.
The ads lure Android users to a cloned TradingView site and a malicious APK; the campaign was still active when reported.
The dropper requests accessibility permissions, displays fake update prompts, and removes itself after launching the hidden payload.
The Brokewell-based malware can steal cryptocurrency and credentials, capture lock-screen PINs, scrape Google Authenticator codes, and intercept SMS.
Its surveillance and remote-control functions include keylogging, screen and audio recording, camera and location access, and commands to send SMS, place calls, or uninstall apps.
The malware communicates with attackers through Tor and WebSockets; the article provides sample hashes and Bitdefender detection names.
The researchers say this Android campaign is part of a broader Facebook Ads operation that has impersonated multiple brands and targeted Windows users.

Article Details

Attack Vectors: Malicious Facebook ads impersonated TradingView and lured Android users to a cloned webpage and a malicious APK.
The initial app decrypted and launched a dropped APK, prompted the user to grant accessibility permissions, and then uninstalled itself.
The dropped app used overlays and fake prompts to solicit a lock-screen PIN and disguise its activity.
The malware communicated with attackers through Tor and WebSockets and supported remote commands, including data theft, surveillance, and device control.
Defensive Notes: Avoid sideloading apps and install apps only from official stores such as Google Play.
Treat ads cautiously, including ads shown on trusted platforms, and check download URLs for lookalike domains.
Review app permissions; accessibility access or requests for a lock-screen PIN without a clear reason are warning signs.
Bitdefender recommends using scam-detection tools and a trusted Android security solution.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`new-tw-view[.]online`	Lookalike domain hosting the cloned TradingView page used to redirect Android targets.
MD5	`58d6ff96c4ca734cd7dfacc235e105bd`	MD5 checksum of the packed APK dropped by the initial application.
MD5	`788cb1965585f5d7b11a0ca35d3346cc`	MD5 checksum of the malicious APK file.
SHA256	`39669a3663829b380c7a776857021ac8a325cf6c0f709dd502f5f0a0945da953`	Hash listed for a dropper sample downloaded from the Facebook ads.
SHA256	`66b5cf0fe3eb2506ce38701acabc242323e1cdbdb2b0a96909936477e03e0cf3`	Hash listed for a dropped malware sample.
SHA256	`6dd93a18b00db0f16042cd95ed45227aca0f850844e1cb9923e83df405757660`	Hash listed for a dropper sample downloaded from the Facebook ads.
SHA256	`78b3db9b68a4b62c6c4fffdcf0d0125aca464dbb4a6ef3526ac7c7ea1cfe88e4`	Hash listed for a dropped malware sample.