Cybercriminals are increasingly leveraging Facebook’s advertising platform as a covert delivery mechanism for highly advanced Android malware. Bitdefender Labs has documented a wave of attacks in 2025 that reveals just how sophisticated malvertising campaigns have become.
By capitalizing on recognizable trading brands and adapting messaging to various regions and languages, these threat actors are weaponizing “free” tools to lure unsuspecting users into installing destructive spyware.
Free Trading Tools Turned Trap
Beginning in July 2025, Bitdefender analysts identified at least 75 unique Facebook ads, each designed to appear as genuine promotions for a free Android version of TradingView Premium.
Although these ads featured official-looking branding and visuals, they directed users to a deceptive website that closely mimicked TradingView’s legitimate landing page.
Upon visiting the fraudulent site, victims were prompted to download an APK file from an external domain. Once installed, this APK immediately requested advanced permissions, such as accessibility access, and executed a sequence of background steps to entrench itself on the device further.
The application, now identified as an evolved variant of the Brokewell malware, employs layered obfuscation and encrypted resources to evade detection.
After gaining the necessary permissions through convincingly designed overlay prompts, sometimes appearing over trusted apps like YouTube, the dropper module installs a secondary APK without a launcher, then removes itself to erase evidence of the infection.
This approach not only fools users but also complicates digital forensic efforts.
Inside the Android Malware Campaign
The true sophistication of this malware becomes evident in its capabilities. The Brokewell remote access trojan, once active, grants attackers extensive control over compromised devices.
It not only scans for sensitive financial details such as cryptocurrency addresses and IBANs, but also actively bypasses two-factor authentication by extracting codes directly from Google Authenticator.
The malware can overlay fake login screens on popular apps, monitor user inputs, steal cookies, and even discreetly enable microphones and cameras, turning smartphones into surveillance tools.
Particularly alarming is the malware’s SMS hijacking function, which intercepts authentication and banking codes, opening a path to direct financial theft.
Communication with the attacker’s infrastructure is maintained through anonymized Tor networks and secure WebSockets, allowing remote operators to execute commands like sending texts, uninstalling security apps, gathering device data, and even activating a self-destruct mode to delete all traces of the infection.
A Global Operation, Evolving Fast
What sets this campaign apart is its global reach and adaptive nature. The threat actors localize ads in multiple languages, including Vietnamese, Spanish, Portuguese, Thai, Arabic, and Chinese, and impersonate a diverse range of brands, from leading cryptocurrency exchanges to financial apps.
This multilingual, multi-brand approach enables the malware to evade regional suspicion and extend its reach worldwide. Downloads are tailored to device types, meaning desktop, iOS, and Mac users often see only benign or familiar content, while Android users receive the actual threat.
Bitdefender detects these infections as Android.Trojan.Dropper.AVV and Android.Trojan.Banker.AVM, urging mobile users to install only from trusted sources, review permissions carefully, and deploy advanced mobile security solutions to remain protected.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
.jpg?resize=1068,580&ssl=1&description=Free Trading Tools - Cybercriminals are increasingly leveraging Facebook’s advertising platform as a covert delivery mechanism for highly.){kind=link}