Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards

This report documents an active JSCEAL malware campaign in Korea where threat actors used Facebook ads to lure users to fake cryptocurrency exchange sites that deliver OS-specific installers (Windows BAT, macOS PKG). The malware leverages Node.js to execute payloads, establishes persistence (scheduled tasks, LaunchAgents), disables or bypasses Defender protections, and exfiltrates sensitive data (clipboard contents, credentials, machine identifiers); the report includes indicators and remediation guidance for both Windows and macOS.