Fake Facebook MidJourney AI page promoted malware to 1.2 million people

Researchers observed large-scale Facebook malvertising campaigns where attackers hijack or impersonate popular AI service pages and run ads promoting fake AI tools; victims who follow links or download purported desktop apps receive information-stealing malware (Rilide, Vidar, IceRAT, Nova) that exfiltrates browser credentials, cookies, crypto wallet data and payment information. The operators used cloned landing pages, GoFile links, and community posts to legitimize scams, reaching audiences in multiple European countries and amassing pages with hundreds of thousands to over a million followers before takedowns.