Fake TradingView ads used to spread Brokewell Android malware

[fullfitlarry]

So here we go again, cyber criminals are abusing Facebook ads with a new malware called Brokewell. Initially, criminals did take advantage targeting Windows desktop users, now they shift their focus towards android user and deploying a crypto stealing malware.



As per their analysis, the malware campaign created 75 malicious ads. And the ads that their used is TradingView. And as we all know most of crypto enthusiast are using it as this financial platform as we used it for our technical analysis. And they are tricking us to download the premium version of this apps. And for those who fall for it, they will be redirected to a close site.

Code:

new-tw-view.online

And then you unsuspectingly downloaded the malicious apk file

Code:

tradiwiw.online/tw-update.apk

Once it is installed, it will begin to ask powerful permissions, such as accessibility access thru hiding with fake updates. They can even trick users into giving their lock in pincode. This is how powerful this malware is.

Capabilities:

Crypto theft – Scanning for BTC, ETH, USDT, IBANs, and more.
2FA bypass – Scraping and exporting codes from Google Authenticator.
Account takeover – Providing the possibility to overlay fake login screens
Surveillance – Recording screens, keylogging, stealing cookies, activating the camera and microphone, and tracking live location.
SMS interception – Hijacking the default SMS app to intercept messages, including banking and 2FA codes.
Remote control – Communicating with attackers over Tor and WebSockets, with commands to send SMS, place calls, uninstall apps, or even self-destruct.

And to add to that, it's localized to several languages:



https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide

[BitMaxz]

I won't fall for this trap, and I don't trust downloading TradingView outside the Play Store. If I'd seen this on Facebook, I could easily determine if it's legit or not.

At the first glance I could tell that this is a fake TradingView since the title of the ads is far from the original one, which is TradingView.

I'm sure their target are newbies since old TradingView users already had this tool, and TradingView already warns users about this fake TradingView from their feeds below.

- https://www.tradingview.com/news/financemagnates:1dbd5d711094b:0-fake-tradingview-ads-offer-free-premium-and-deliver-malware-instead/

These days, all ads on Facebook cannot be trusted; you should avoid any ads on Facebook because they will always redirect you to phishing sites, at least from what I've seen. The majority of the ads I see are AI-generated and promote fake and counterfeit products.
We must avoid clicking any ads on Facebook if you don't want to fall for this.

[DYING_S0UL]

If I remember correctly, a few months ago I saw a similar case with the TradingView app or a similar app. Same method of scamming, tricking users into installing some premium version of the app on mac and windows, but it was actually a scam app designed to drain the wallet. Scammers would use different social platforms to spread these malware app, mostly on Reddit.

Found it: Beware of ‘cracked’ TradingView — it’s a crypto-stealing trojan

These are one of the most common scamming techniques. We should always remember nothing is free. So if anyone saying "free of cost", "premium app" we should doubt that source.

[logfiles]

Blame it on Facebook and Google. All they care about is money and not the safety of the users. Why they don't moderate scams, malware, phishing links that use their platforms to advertise like the way they would moderate explicit content or "hate speech" is beyond my understanding.
Such ads shouldn't appear anywhere on social media, if only they were not greedy companies.

[Yaunfitda]

And even if this is for mobile Android version, if you look at Facebook today, you will still find this kind of ads, mostly crypto exchange like Binance and others. And I also remember that we have that thread here as well giving warnings so that we won't fall for it. So now, it's the next best thing after crypto exchange and then mobile phone, it's one of the most used apps for us, Tradingview. Hopefully no one will fall here as there was a warning already. Maybe for experience traders, who won't, but there are thousands of newbies like every day trying to get their hands on crypto and maybe this is the target of this criminals.

[arwin100]

And even if this is for mobile Android version, if you look at Facebook today, you will still find this kind of ads, mostly crypto exchange like Binance and others. And I also remember that we have that thread here as well giving warnings so that we won't fall for it. So now, it's the next best thing after crypto exchange and then mobile phone, it's one of the most used apps for us, Tradingview. Hopefully no one will fall here as there was a warning already. Maybe for experience traders, who won't, but there are thousands of newbies like every day trying to get their hands on crypto and maybe this is the target of this criminals.

Seems like Meta is not regulating well those ads spreading on their platform since we could see phising sites and now that worse posted by OP which is malwares which can compromise lots of people.

It seems that we really need to be more careful and stop looking at promotions on social media sites especially if this is not came to valid sources. Also we should warn our people around us who's also into crypto that they need to be aware about those risk spreading around.

I hope newbie would learn how to verify first on attractive things they see online before grabbing those offers.

[joniboini]

Seems like Meta is not regulating well those ads spreading on their platform since we could see phising sites and now that worse posted by OP which is malwares which can compromise lots of people.

I'm surprised Facebook is still around tbh. I no longer use them after I stopped needing to use my social media for my job. I thought Twitter replaced them. Judging from what I've seen in my circles, it sounds like they still have significant users. I remember reading that they advertised banned services in my country too, which can be another proof to argue that they probably don't filter their ads that well.

As long as users understand the basic common sense to verify apk before they install them, or always download from legitimate websites, this attack should be avoidable in most cases.

[Davidvictorson]

Seems like Meta is not regulating well those ads spreading on their platform since we could see phising sites and now that worse posted by OP which is malwares which can compromise lots of people.

It is a pity that Meta has lost control of their platform. They are no longer trying to protect their users. Rather, they are in an invisible tusle with X on who will have the most users so much so that scammers and hackers have failed to be vetted properly before granting th access to use their account. In my estimation, Facebook has the most crypto ignorant people so they are easy to get them to click on a link and steal their stuff from their devices.

[tabas]

I think this thread better go to the Scam Accusations. I've made similar threads that have been posted there as well. And as for Meta, they are not the same with google. They don't filter the ads that they approve and all they care is the money that have been paid for them to put those posts and ads into sponsored ads. And many of these scams have been existing in their platform.

[Patikno]

So here we go again, cyber criminals are abusing Facebook ads with a new malware called Brokewell. Initially, criminals did take advantage targeting Windows desktop users, now they shift their focus towards android user and deploying a crypto stealing malware.

https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide

Based on the information you provided, I see that cybercriminals are trying to exploit loopholes in the meta platform or facebook ads, and in the minds of potential victims. As for the platform, there should be stricter action against advertisers who potentially commit fraud like this, and that should already be part of their duties. In fact, I often find suspicious ads related to crypto and I immediately report them using the platform report feature, but unfortunately, they don't seem to care much about reports like this (even though, I am sure many others also report the same as I do). As for the ad viewers or potential victims, it is best to avoid such traps, and also must check and re-check (verify) any information, especially they try to lure potential victims with the lure of $0 for a premium subscription (based on the information), even though the official website only has a monthly subscription fee, a year for free? Impossible.

So in essence, we should be skeptical of the information we get, don't be easily tempted, verify it from an official or trusted site, if possible see reviews from trusted people, so we can avoid this kind of fraud, especially for beginners or newbies, this is very important to pay attention to. If we find something suspicious, report it immediately, especially to the relevant parties, so that they can immediately try to handle it, or at least immediately provide general notification at the outset.

[suzanne5223]

I won't fall for this trap, and I don't trust downloading TradingView outside the Play Store. If I'd seen this on Facebook, I could easily determine if it's legit or not.

Of course, you won't fall for the trap because you're totally familiar with the genuine trading view website link, but I believe online scammer always creates stunts to target newbie traders.
Meanwhile, just trusting the app you downloaded on the Play Store without additional examination using an open source platform like Exodus won't guarantee total protection based on the previous issue where Google Play Store was accused of not doing proper research and testing of the app they have on the platform, which is why people are victims of spam despite downloading the app on the platform.

 

[Yaunfitda]

And even if this is for mobile Android version, if you look at Facebook today, you will still find this kind of ads, mostly crypto exchange like Binance and others. And I also remember that we have that thread here as well giving warnings so that we won't fall for it. So now, it's the next best thing after crypto exchange and then mobile phone, it's one of the most used apps for us, Tradingview. Hopefully no one will fall here as there was a warning already. Maybe for experience traders, who won't, but there are thousands of newbies like every day trying to get their hands on crypto and maybe this is the target of this criminals.

Seems like Meta is not regulating well those ads spreading on their platform since we could see phising sites and now that worse posted by OP which is malwares which can compromise lots of people.

It seems that we really need to be more careful and stop looking at promotions on social media sites especially if this is not came to valid sources. Also we should warn our people around us who's also into crypto that they need to be aware about those risk spreading around.

I hope newbie would learn how to verify first on attractive things they see online before grabbing those offers.

Yes, historically, even if they said that they are watching every ads that come to them, still though, they are being taking advantage by criminals by weaponizing their ads just like in this case. And they have been called to be honest, and said that they will do everything in their power. Specially when there times that deep fake was a thing on Youtube and they have even been sued. But nothing comes out of it obviously as this is already 2025 and still criminals can slip using their apps in the social media to have this kind of phishing. Hopefully, another wake up call for them and for us crypto enthusiast as well.

[PrivacyG]

Although I do not agree with what Google has been doing to Android for the past few years, I believe there are enough barriers before you can actually get scammed by this software if you have no knowledge about Android or Android security in general.

Nowadays phones come with all sorts of layers to protect you from installing unknown apps.  You have to click the fake link and not realize it is fake.  You have to edit some settings in your phone, Google Protect or however it is called is then warning you of the application being unknown and potentially harmful et cetera.  Rumors say that soon Android will not even be able to install unknown apps unless signed by trusted developers and I bet people will still get scammed and fooled.  I mean come on.  We should not baby sit every phone owner now.  Where is responsibility?

[Okuri]

Blame it on Facebook and Google. All they care about is money and not the safety of the users. Why they don't moderate scams, malware, phishing links that use their platforms to advertise like the way they would moderate explicit content or "hate speech" is beyond my understanding.
Such ads shouldn't appear anywhere on social media, if only they were not greedy companies.

Totally agree, it’s frustrating! Facebook and Google should prioritize user safety over profit and moderate scams as strictly as explicit content. Greed shouldn’t compromise our security.

[Rustam Meraj]

Yes, historically, even if they said that they are watching every ads that come to them, still though, they are being taking advantage by criminals by weaponizing their ads just like in this case. And they have been called to be honest, and said that they will do everything in their power. Specially when there times that deep fake was a thing on Youtube and they have even been sued. But nothing comes out of it obviously as this is already 2025 and still criminals can slip using their apps in the social media to have this kind of phishing. Hopefully, another wake up call for them and for us crypto enthusiast as well.

It is completely understandable why you are so frustrated by this issue. It is serious problem when criminals are able to use these websites to take advantage of people particularly after companies had promised to solve these problems. Use of deepfakes and other advanced techniques makes it even harder to spot scam. You are correct that this situation should serve as wake up call for both companies that run these websites and for all users to be extremely careful.

[Lucius]

Blame it on Facebook and Google. All they care about is money and not the safety of the users. Why they don't moderate scams, malware, phishing links that use their platforms to advertise like the way they would moderate explicit content or "hate speech" is beyond my understanding.
Such ads shouldn't appear anywhere on social media, if only they were not greedy companies.

We can blame them all we want, but the fact is that they don't care about the end user, and that legally they are fully insured in case someone sues them for financial damage. It all comes down to the fact that everyone needs to be careful about their actions, whether it's on FB or this forum, because that's unfortunately how the internet works.

The only way to suppress such advertisements is detailed checks by all these companies, which they do not want to carry out because on the one hand it is too expensive for them, and on the other hand they would lose too many clients. It has been my decision for a long time not to use FB and similar social networks, not because I am afraid of false advertisements, because it has already been scientifically proven that they are extremely harmful for everyone who uses them, especially for children.

[masulum]

We can blame them all we want, but the fact is that they don't care about the end user, and that legally they are fully insured in case someone sues them for financial damage. It all comes down to the fact that everyone needs to be careful about their actions, whether it's on FB or this forum, because that's unfortunately how the internet works.

The only way to suppress such advertisements is detailed checks by all these companies, which they do not want to carry out because on the one hand it is too expensive for them, and on the other hand they would lose too many clients. It has been my decision for a long time not to use FB and similar social networks, not because I am afraid of false advertisements, because it has already been scientifically proven that they are extremely harmful for everyone who uses them, especially for children.

I also agree to blame the ad providers because of their inability to anticipate malware in every new ad added to their systems. I fully understand that ads come in daily, and it's likely not human to screen them. This would require a large team to do it manually. This is what allows malware and phishing ads to slip through so easily. I often report ads I don't like, but it still doesn't help, because if I report company A, company B will be the one running the same ad. It seems that advertisers use 3rd parties to distribute ads to avoid blocking and reporting.

[notocactus]

Facebook is scam.

Why I say this?
Not only fake tradingview advertisement but there are fake advertisements with brands like Binance, OKX, Remitano, Kucoin and many others. They are too raw scams as their links can be easily seen and known that it none of those links are from those brand official websites.

What did I do?
I reported those scam advertisements to Facebook and it took them one or two weeks before they responded to my reports. Their replies are they disagree with all my reports and won't delete or ban those advertisements on Facebook.

Those advertisements are scam but how Facebook handle reports against scams is even more scam. You can try to do report and verify what I said.

If they are responsible, they must verify those domain links before approving them on those websites. They are irresponsible initially and when handling my reports. Double irresponsibility and scam, it is Facebook.

[qwertyup23]

And even if this is for mobile Android version, if you look at Facebook today, you will still find this kind of ads, mostly crypto exchange like Binance and others. And I also remember that we have that thread here as well giving warnings so that we won't fall for it. So now, it's the next best thing after crypto exchange and then mobile phone, it's one of the most used apps for us, Tradingview. Hopefully no one will fall here as there was a warning already. Maybe for experience traders, who won't, but there are thousands of newbies like every day trying to get their hands on crypto and maybe this is the target of this criminals.

Doesn't Facebook have all the necessary means and funds to hire people to double check the enlistment of their ads before approval? If this were the case that they accept ads that have hidden malware or deceitful ads that trick people, then that is more reason that we should be more vigilant whenever we click random links on all social media platforms.

What you also said is right- if we cannot altogether absolutely prevent people from getting scammed, the least thing that we can do is to consistently inform everyone about new scams and other hacks that can alert at least some of us.

I also agree to blame the ad providers because of their inability to anticipate malware in every new ad added to their systems. I fully understand that ads come in daily, and it's likely not human to screen them. This would require a large team to do it manually. This is what allows malware and phishing ads to slip through so easily. I often report ads I don't like, but it still doesn't help, because if I report company A, company B will be the one running the same ad. It seems that advertisers use 3rd parties to distribute ads to avoid blocking and reporting.

Like I mentioned above, Facebook is a billion dollar company. They can easily have all the necessary security measures if they designate and allocate such budget for that. But the fact that there are advertisements being approved despite being a scam really bugs me about their system.

[Dave1]

We can blame them all we want, but the fact is that they don't care about the end user, and that legally they are fully insured in case someone sues them for financial damage. It all comes down to the fact that everyone needs to be careful about their actions, whether it's on FB or this forum, because that's unfortunately how the internet works.

The only way to suppress such advertisements is detailed checks by all these companies, which they do not want to carry out because on the one hand it is too expensive for them, and on the other hand they would lose too many clients. It has been my decision for a long time not to use FB and similar social networks, not because I am afraid of false advertisements, because it has already been scientifically proven that they are extremely harmful for everyone who uses them, especially for children.

I also agree to blame the ad providers because of their inability to anticipate malware in every new ad added to their systems. I fully understand that ads come in daily, and it's likely not human to screen them. This would require a large team to do it manually. This is what allows malware and phishing ads to slip through so easily. I often report ads I don't like, but it still doesn't help, because if I report company A, company B will be the one running the same ad. It seems that advertisers use 3rd parties to distribute ads to avoid blocking and reporting.

But they have the capability to have some humans to review everything first or even after the ads have been shown in Facebook, to take it down because it contains malware. Even if it is a 3rd party, Meta is the last filter as it is going to be displayed in their blue app.

So it boils down to them on how they are gong it react. On our part, all we can do is to report it as we see it. That is the best thing that we can contribute to clear the space of this scammers and criminals so that at least they won't victimized.

Everyone has to do their thing here, one way or another.