Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials

Trustwave SpiderLabs observed a social‑engineering campaign leveraging fake Facebook job ads and a weaponized PDF that leads victims to download a .URL shortcut which drops a .CPL executed via control.exe to launch a PowerShell loader from GitHub, ultimately deploying a Windows infostealer named Ov3r_Stealer. Ov3r_Stealer harvests IP/location, hardware info, passwords, cookies, credit card data, auto‑fills, browser extensions, crypto wallets, Office documents and AV lists, exfiltrating data to a Telegram channel; it shares code with the Phemedrone stealer and may be reused as a loader for additional payloads or sold as MaaS.