Malvertising on Meta's ads targets Android with Brokewell spyware

Cybersecurity researchers have uncovered a widespread malvertising campaign on Meta's advertising network that is tricking Android users into installing Brokewell spyware by posing as a free TradingView Premium app. Bitdefender researchers first observed the campaign in late July and say at least 75 localized ads have been used to lure tens of thousands of users in the European Union within about a month.

The ads, which mimic TradingView branding and visuals, specifically target mobile devices. Clicking from an Android phone redirects the user to a cloned website that initiates a download of a trojanized .apk file. Desktop and other non-Android clicks typically receive benign content, researchers said, a design meant to evade casual detection. Once installed, the dropper requests broad accessibility permissions, displays fake update prompts and even attempts to harvest the device lock screen PIN. The dropper then removes itself to avoid discovery while the payload, Brokewell, activates.

Bitdefender described this incarnation of Brokewell as an advanced spyware and remote access trojan that combines crypto-theft tools with extensive surveillance and control features. The malware...