Global Crypto Users Warned of Malware via Deceptive Ads Affecting 10 Million

An estimated 10 million people globally have been exposed to deceptive online advertisements promoting counterfeit cryptocurrency applications laced with malware, according to a warning from cybersecurity firm Check Point. The malware campaign, named “JSCEAL,” impersonates well-known crypto trading platforms such as Binance, MetaMask, and Kraken. The campaign has been active since at least March 2024 and continues to evolve, using sophisticated tactics to evade detection [1].

The malicious advertisements lead users to fake websites where they are prompted to download the infected apps. Once installed, the malware collects sensitive information, including keyboard inputs, Telegram account details, autocomplete passwords, and browser cookies. It also manipulates crypto-related browser extensions, enabling attackers to access and control user accounts and funds [1].

The campaign leverages JavaScript, a widely used programming language that does not require user input to execute, to carry out its operations. This makes it particularly difficult to detect and analyze. The malware’s anti-evasion techniques have contributed to its low detection rate and prolonged presence on infected devices [1].

Check Point reported that Meta’s ad tools identified 35,000 malicious ads promoted in the first half of 2025, resulting in millions of views across the EU alone. The firm estimates that at least 3.5 million users in the EU were exposed to the campaign, with the global reach potentially exceeding 10 million. The ads often mimic Asian crypto and financial institutions, taking advantage of the region’s high social media user base [1].

The malware’s ability to remain undetected for extended periods poses a serious threat to crypto users, who often have limited recourse in the event of theft. Blockchain’s anonymity further complicates efforts to trace and prosecute the perpetrators [1].

Cybersecurity experts emphasize that users should exercise caution when downloading crypto apps. They recommend verifying the legitimacy of an app before installation, avoiding suspicious advertisements, and using only trusted app stores and verified developers. Anti-malware software that can detect malicious JavaScript execution is also seen as a critical line of defense [1].

The incident highlights a broader issue with online advertising platforms, which can serve as conduits for malware distribution if not properly monitored. Regulators and platform operators face growing pressure to establish stricter accountability frameworks to prevent digital advertising spaces from being exploited for fraudulent purposes [1].

Source: [1] Crypto users warned as ads push malware-laden crypto apps (https://cointelegraph.com/news/crypto-users-warned-as-ads-push-malware-laden-crypto-apps)