Fake Crypto Exchange Ads on Facebook Spread Malware

Bitdefender uncovered a multi-stage malware campaign leveraging deceptive Facebook ads and counterfeit cryptocurrency exchange pages (using celebrity imagery and hijacked/phony Facebook accounts) to distribute a malicious desktop client; the client drops a DLL that launches a .NET local C2 server, executes encoded PowerShell scripts to fetch further malware, and uses targeted ad delivery and anti-sandbox checks to evade detection — hundreds of accounts and many ads (one page ran 100 ads in 24 hours) indicate broad, active distribution.