Loading story…
A sophisticated cybercriminal campaign has significantly expanded its reach by leveraging Google Ads and YouTube to distribute malware disguised as free access to TradingView Premium, a popular financial trading analysis service. Security researchers from Bitdefender Labs have tracked this operation for over a year, noting its evolution from initially exploiting Facebook Ads to now targeting a broader audience through Google’s advertising ecosystem and YouTube. The attackers employ highly organized tactics, utilizing more than 500 unique website addresses and deploying thousands of malicious ads daily in multiple languages, including English, Vietnamese, and Thai. To enhance credibility and evade detection, the threat actors hijack legitimate, verified business accounts on Google and YouTube, such as a Norwegian design agency’s Google advertiser account. They also compromise verified YouTube channels, erasing original content and rebranding them to closely mimic the official TradingView channel, complete with authentic logos, banners, and mirrored playlists. These fake channels use unlisted videos, which are promoted through paid ads, to lure victims with promises of secret methods for obtaining TradingView Premium for free. One such video amassed over 182,000 views in just a few days, demonstrating the campaign’s aggressive reach. Users who click on these ads are redirected to malware-laden downloads designed to steal credentials and compromise accounts. The campaign’s expansion to Google and YouTube exposes a much larger pool of content creators and regular users to credential theft and account compromise. The use of hijacked, verified accounts and sophisticated impersonation techniques makes the scam particularly convincing and difficult for users to detect. Researchers emphasize that the campaign’s persistence and adaptability, including its ability to quickly shift platforms and tactics, pose a significant threat to the financial and personal security of targeted individuals. The operation’s global scale and multilingual approach indicate a well-resourced and coordinated threat actor. Security experts recommend heightened vigilance, especially when encountering offers for free premium services through ads, and urge platforms to strengthen verification and monitoring processes to prevent account hijacking. The campaign’s technical sophistication, including the abuse of advertising infrastructure and social engineering, highlights ongoing challenges in combating malvertising and credential theft. Organizations and individuals are advised to verify the authenticity of offers and channels before engaging with advertised content. The incident underscores the need for continuous monitoring of advertising platforms for signs of compromise and malicious activity. Bitdefender’s ongoing research into the campaign provides valuable insights into the evolving tactics of cybercriminals targeting the financial sector. The expansion of this scam to major platforms like Google and YouTube marks a significant escalation in the threat landscape for both content creators and everyday users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Hexastrike reported an active Reddit-based campaign using fake free TradingView Premium offers across at least five subreddits to deliver Vidar infostealer to Windows users and AMOS stealer to macOS users. The operation used aged or compromised Reddit accounts, compromised business websites for payload hosting, and rapidly rotated domains to evade detection.
Follow-on coverage highlighted that Google Ads were being used to deliver a trojan masquerading as TradingView Premium, reinforcing the cross-platform nature of the campaign. The reporting did not indicate a separate incident, but added technical clarity on the malware delivery method.
Researchers reported that the same 'TradingView Premium' malware scam had moved beyond Meta and was being distributed through Google Ads and YouTube. This marked an escalation in the campaign's reach across major advertising and content platforms.
A malware campaign using fake 'TradingView Premium' offers was already active on Meta platforms before later expanding elsewhere. The scam used malicious ads to lure users into downloading a trojanized file disguised as premium trading software.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcetechradar.com
Open sourcehackread.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly exploiting social media and video platforms such as Facebook and YouTube to distribute scam advertisements, deepfakes, and malware. Former Meta executives have launched a nonprofit initiative to address the growing lack of transparency and stagnation in anti-scam ad technology, highlighting the persistent evolution of scam tactics and the use of AI to create convincing fraudulent content. Meanwhile, YouTube faces a surge in scams and malware campaigns, with attackers leveraging the platform’s recommendation algorithms, hijacked accounts, and AI-generated videos to reach wide audiences. Notable operations include the "YouTube Ghost Network," which used thousands of videos on compromised channels to lure users into downloading malware or visiting phishing sites, and scams that migrated from Facebook Ads to YouTube and Google Ads, exploiting trusted brands and hijacked ad accounts. The sophistication of these scams is amplified by the use of deepfakes and synthetic identities, making it increasingly difficult for both users and traditional moderation systems to detect fraudulent activity. Security researchers emphasize the need for advanced detection technologies, such as light spectrum analysis and cryptographic verification, to combat these threats. The ongoing arms race between scammers and platform defenders underscores the urgent need for industry-wide improvements in transparency, technology investment, and layered verification standards to restore trust in online advertising and content platforms.
Jun 29, 2026
A long-running malvertising operation dubbed **SourTrade** has been targeting retail traders and cryptocurrency users with fake ads and spoofed sites impersonating **TradingView**, **Solana**, and **Luno**. Researchers said the campaign has operated since late 2024 across 12 countries and 25 languages, selectively serving malicious pages to intended victims in regions including Asia-Pacific, Latin America, Africa, Australia, and Great Britain while showing analysts and bots blank or benign content through cloaking. Instead of delivering a static payload, SourTrade uses a browser-side assembly chain to build a unique Windows executable on the victim system. The landing page provides build instructions, retrieves a clean **Bun** runtime from separate infrastructure, generates additional bytes locally with **AES-CTR**, and uses browser features such as **ServiceWorker** and **SharedWorker** to assemble the final malware in memory before triggering a same-origin download. Researchers said the approach frustrates static hash-based detection, file fingerprinting, and simple network-log review, and noted the campaign has abused advertising ecosystems linked to **Google**, **Meta/Facebook**, and **X/Twitter** while publishing malware hashes and domains as indicators of compromise.
Aug 14, 2026
A sophisticated cybercriminal campaign has been identified targeting macOS users, particularly developers, by leveraging fake download portals that impersonate trusted platforms such as Homebrew, LogMeIn, and TradingView. The attackers have registered over 85 domains that closely mimic the legitimate sites of these popular tools, using convincing branding and user interfaces to deceive visitors. These malicious domains are promoted through Google Ads, ensuring that they appear prominently in search results and increasing the likelihood that unsuspecting users will visit them. Once on the fake sites, users are instructed to copy and execute a curl command in their Terminal, which initiates the download and installation of infostealing malware. The primary payloads delivered in this campaign are AMOS (Atomic macOS Stealer) and Odyssey Stealer, both of which are capable of harvesting sensitive information such as system details, browser data, and cryptocurrency credentials from infected machines. The campaign employs advanced social engineering tactics, including clipboard manipulation and command obfuscation, to increase the success rate of infections. Researchers from Hunt.io have mapped the infrastructure supporting this operation, noting that the attackers reuse IP addresses and SSL certificates across multiple domains, indicating a persistent and well-organized effort. The infrastructure has been active for several years, with some IP addresses registered under personal names, suggesting a degree of operational continuity and experience. The campaign does not rely on exploiting software vulnerabilities but instead exploits user trust in widely used open-source and financial tools. The use of Google Ads as a distribution vector highlights the attackers' willingness to invest in paid advertising to reach their targets. The campaign's focus on the developer community is particularly concerning, as compromised developer systems could lead to broader supply chain risks. Security researchers have emphasized the importance of verifying download sources and being wary of unsolicited installation instructions, especially those involving Terminal commands. The ongoing nature of the campaign, with continuous adaptation of infrastructure and tactics, underscores the need for vigilance among macOS users. The discovery of this campaign began with public reports from independent researchers, which were then corroborated and expanded upon by threat intelligence teams. The scale and persistence of the operation suggest that it is likely to continue evolving, posing a significant threat to the macOS ecosystem. Organizations are advised to educate users about the risks of malvertising and to implement technical controls to block access to known malicious domains. The campaign demonstrates the increasing sophistication of social engineering attacks targeting macOS, a platform often perceived as less vulnerable than Windows.
Jun 29, 2026