Log in
A persistent and technologically advanced malvertising campaign is actively exploiting Facebook’s advertising platform, with cybercriminals impersonating trusted cryptocurrency exchanges to ensnare unsuspecting users in a web of malware.
According to a detailed investigation by Bitdefender Labs, this campaign has evolved into a formidable threat, deploying complex front-end scripts, strategic back-end payloads, and dynamic user-tracking mechanisms designed to evade both user suspicion and security countermeasures.
Multi-Layered Attack Tactics and Techniques
The campaign, reportedly ongoing for several months, bombards Facebook with a constant stream of fresh, seemingly legitimate ads that capitalize on the brand equity of high-profile cryptocurrency platforms such as Binance and TradingView.
These ads, often enhanced with endorsements from influencers or celebrities like Elon Musk and Cristiano Ronaldo, promise lucrative financial opportunities or exclusive crypto bonuses.
Unsuspecting users who click through are redirected to meticulously crafted phishing websites, which not only closely mimic the appearance of the targeted exchanges but also instruct users to download a “desktop client”-the entry point for malware infection.
Central to the campaign’s stealth is the collaboration between the phishing site’s front-end and a local host on the victim’s machine.
This architecture enables malicious payloads to be delivered covertly, often bypassing traditional endpoint security and sandbox analysis.
The actors employ rigorous anti-analysis checks, leveraging unique Facebook Ad query parameters to ensure malware is only served to valid targets, while automated or suspicious environments receive innocuous content.
Moreover, the campaign utilizes granular demographic filtering, often targeting males with an interest in technology and cryptocurrencies, and tailors its infection chain to regional preferences, such as a notable focus on users in Bulgaria and Slovakia.
Malware Deployment and Command Techniques
Once the victim proceeds to install the disguised application, typically named installer.msi, the malware further executes processes via legitimate system binaries (e.g., msedge_proxy.exe) and deploys a malicious DLL.
This component establishes a local .NET-based server, typically on ports 30308 or 30303, which acts as the command hub for the compromised host.
Through exposed routes-/set and /query-this local server enables remote payload execution and targeted data exfiltration, including the collection of system fingerprints, installed software, GPU information, geographic data, and OS or BIOS details via WMI queries.
In an additional layer of sophistication, the malicious front-end script creates a JavaScript SharedWorker that communicates directly with the local server, orchestrating further payload delivery and dynamically executing PowerShell scripts.
These scripts establish persistent connections to attacker-controlled command-and-control (C2) infrastructure, enabling ongoing retrieval and execution of additional malicious payloads.
If the victim environment matches criteria suggestive of automated analysis or a sandbox, the scripts may execute only benign commands-such as indefinitely sleeping processes-to frustrate security researchers and delay detection.
The scale of this operation is significant, with hundreds of Facebook accounts propagating thousands of malvertising campaigns.
Some accounts have managed to post over a hundred ads in a single day, accruing thousands of impressions before takedown.
Despite Facebook’s efforts to remove harmful content, the campaign’s adaptive infrastructure, rapid renewal of malicious ads, and exploitation of Facebook’s powerful targeting tools have enabled it to persist and evolve.
According to the Report, Bitdefender’s research indicates only a few security platforms currently detect the full scope of this campaign, as it combines sophisticated social engineering, technical obfuscation, and multi-stage payloads.
The attackers’ use of sandbox and traffic metadata checks, multiple infection vectors, and real-time payload updates presents a significant challenge for security professionals.
Ultimately, this campaign underscores the heightened risks posed by the intersection of social media advertising, cryptocurrency hype, and advanced cybercriminal tactics.
Organizations and individuals are urged to remain vigilant, apply robust endpoint protections, and treat unsolicited offers-especially those involving crypto platforms on social media-with extreme caution.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
The post Cybercriminals Exploit Facebook Ads to Launch Sophisticated Multi-Stage Malware Campaigns appeared first on Cyber Security News.
.webp)
