Facebook Ads Spread Evasive Malware Impersonating Cryptocurrency Platforms
Summary
Bitdefender details an active malvertising campaign using cryptocurrency-brand impersonation and targeted Facebook ads to deliver malware. Its scripts coordinate with a local service to run payloads and collect system data while evading analysis.
Key points
- Researchers found hundreds of Facebook ads and accounts impersonating cryptocurrency platforms, including Binance and TradingView, to promote fake desktop clients.
- Malicious sites filter visitors using ad-tracking parameters, Facebook login status, IP address, operating system, behavioral profiles, and browser choice; suspicious visitors may see harmless content.
- The malware installs a DLL that starts a local .NET server, which website scripts use to run scheduled payloads and issue WMI queries.
- Encoded PowerShell scripts contact command-and-control servers, download further scripts, and can exfiltrate information about installed software, hardware, location, and system configuration.
- Some payloads vary according to collected victim data; sandbox-like environments may receive scripts that only sleep for extended periods.
- Bitdefender reports that its signatures blocked thousands of infection attempts and advises verifying ads, downloading software only from official sources, and reporting suspicious ads.
Article Details
- Attack Vectors
- Malvertising on Facebook promoted cryptocurrency-themed pages and fake desktop-client downloads.
- Impersonated cryptocurrency platforms and a cloned TradingView Facebook page were used to persuade victims to download and install malware.
- Malicious websites filtered visitors using Facebook ad-tracking query parameters, Facebook login state, IP address, operating system, behavioral profiles, and browser choice.
- A malicious front-end script communicated with a local .NET server through a SharedWorker to query WMI and schedule payload execution.
- Encoded PowerShell scripts retrieved additional scripts and payloads from C2 servers, executed them, and exfiltrated system information.
- Defensive Notes
- Be cautious of ads offering free software or unusually large financial gains; verify the source before clicking or downloading.
- Download software only from official vendor websites.
- Use website and link-checking tools and keep security software updated.
- Close suspicious pages that insist on a particular browser or appear polished but are otherwise non-functional.
- Report suspicious Facebook advertisements.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports multiple layers of obfuscation and encoded PowerShell commands in the delivery chain.T1041 · Exfiltration Over C2 ChannelScripts exfiltrated collected information from infected systems to C2 servers.T1047 · Windows Management InstrumentationThe front-end script used WMI queries through the local server to collect machine and system information.T1053.005 · Scheduled TaskThe local server accepted XML payloads for execution through Task Scheduler.T1059.001 · PowerShellEncoded PowerShell scripts retrieved and executed further scripts and payloads.T1082 · System Information DiscoveryThe campaign collected system, operating-system, and BIOS information from infected devices.T1105 · Ingress Tool TransferPowerShell scripts downloaded additional scripts and payloads from C2 servers.T1204.002 · Malicious FileVictims were lured into downloading and installing a malicious desktop-client file.T1497.001 · System ChecksThe malicious websites and payloads screened for automated analysis and sandbox-like environments, serving benign content or sleep-only payloads.T1518.001 · Security Software DiscoveryAn example follow-on script collected information about installed software.
People
Vendors
Bitdefenderthe reputations of well-known cryptocurrency exchanges to lure victims into a maze of malware. Since Bitdefender Labs started investigating, this evolving threat has posed a serious risk by deploying cleverlyMetaCybercriminals use Meta’s ad network to tout quick financial gains and crypto bonuses, with some ads seeking to bolster credibility by featuring the image of public figures such as Elon Musk, Zendaya, and Cristiano
Products
Binancehundreds of ads impersonating trusted cryptocurrency exchanges and trading platforms, including Binance and TradingView. By mimicking well-known brands, the attackers drastically increase the odds that victimsBybitads redirects victims to a site that impersonates a known cryptocurrency platform (Binance, Tradingview, ByBit, SolFlare, MetaMask, Gate.io, MEXC, etc.) , instructing them to download a “desktop client.”FacebookWeaponizing Facebook Ads: Inside the Multi-Stage Malware Campaign Exploiting Cryptocurrency BrandsGate.iosite that impersonates a known cryptocurrency platform (Binance, Tradingview, ByBit, SolFlare, MetaMask, Gate.io, MEXC, etc.) , instructing them to download a “desktop client.”MetaMaskto a site that impersonates a known cryptocurrency platform (Binance, Tradingview, ByBit, SolFlare, MetaMask, Gate.io, MEXC, etc.) , instructing them to download a “desktop client.”MEXCimpersonates a known cryptocurrency platform (Binance, Tradingview, ByBit, SolFlare, MetaMask, Gate.io, MEXC, etc.) , instructing them to download a “desktop client.”Microsoft EdgeNewer variants take a step further, prompting users to open the site using Microsoft Edge; opening it with other browsers leads to random, non-malicious content, further complicating detection efforts.Node.jsreturn other malicious scripts. One example we have encountered is a PowerShell that further downloads a Node.js build, a series of executables and a .jsc file. If the exfiltrated data resembles an automated flow or aPowerShellexecution. In the analyzed case sample, the /set command was used to further execute multiple encoded PowerShell scripts. This chain of encoded commands concluded with a script that downloaded another maliciousSolFlarevictims to a site that impersonates a known cryptocurrency platform (Binance, Tradingview, ByBit, SolFlare, MetaMask, Gate.io, MEXC, etc.) , instructing them to download a “desktop client.”TradingViewof ads impersonating trusted cryptocurrency exchanges and trading platforms, including Binance and TradingView. By mimicking well-known brands, the attackers drastically increase the odds that victims will click