Antivirus

Major new malware strain targets crypto users via malicious ads – here’s what we know, and how to stay safe

Check Point finds thousands of ads promoting fake crypto apps The apps come with an infostealer malware targeting users The infostealer can bypass most antivirus protections Cryptocurrency users are being targeted by a highly sophisticated, widespread cybercriminal campaign with the goal of deploying malware capable of grabbing exchange and wallet information, essentially robbing the people


  • Check Point finds thousands of ads promoting fake crypto apps
  • The apps come with an infostealer malware targeting users
  • The infostealer can bypass most antivirus protections

Cryptocurrency users are being targeted by a highly sophisticated, widespread cybercriminal campaign with the goal of deploying malware capable of grabbing exchange and wallet information, essentially robbing the people of their tokens, experts from Check Point have warned.

Apparently active since March 2024, what makes this campaign, dubbed JSCEAL by the researchers, unique is the use of compiled JavaScript files (JSC), which allows the malware to remain hidden from most traditional antivirus solutions.

The criminals created fake cryptocurrency exchange and wallet apps, which come with an infostealer. They also created websites to host these apps, and managed to purchase thousands of advertisements on the internet to promote the scam. Check Point says that just in the European Union (EU), 35,000 malicious ads were served between January and June 2025.

You may like

  • Cryptocurrencies Criminals are targeting Bitcoin owners on Facebook with a multi-stage malware campaign – follow these steps to stay safe
  • Scam alert Stop using these 22 Android crypto and wallet apps ASAP, or you risk losing all your cryptocurrency
  • Ledger Lifestyle Image Mac users beware – fake Ledger apps are being used by hackers to steal seed phrases and hack accounts

JSCEAL malware

“The use of Facebook’s Ad Library enabled us to estimate the campaign’s reach, while in a very conservative approach we can estimate the total reach of the malvertising campaign at 3.5 million users within the EU alone, and likely above 10 million users worldwide,” the researchers explained.

People who fall for the scam download an MSI installer which triggers “a sequence of profiling scripts” that gather critical system information. These scripts also use PowerShell commands to collect and exfiltrate data, in preparation of the final payload deployment.

This final payload is the JSCEAL malware, which steals crypto-related data such as credentials and private keys. The payload is executed through Node.js, it was said.

What makes this malware particularly dangerous is the use of compiled JavaScript files.

Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Antivirus

From breached to bulletproof: The new rules of cybersecurity are about survival

Listen up, IT professionals. If you’re still treating cybersecurity like a checkbox exercise, you’re already three steps behind the attackers. The digital battlefield has changed, and the old rules no longer apply. Gone are the days when a firewall and antivirus software were enough to keep your organization safe…

Listen up, IT professionals. If you’re still treating cybersecurity like a checkbox exercise, you’re already three steps behind the attackers. The digital battlefield has changed, and the old rules no longer apply. Gone are the days when a firewall and antivirus software were enough to keep your organization safe…
Read More

Continue Reading
Antivirus

Nearly 8,500 small and medium businesses faced cyberattacks through mimic AI tools in 2025: Kaspersky

Global cybersecurity company Kaspersky said on Wednesday that nearly 8,500 users from small and medium-sized businesses (SMBs) faced cyberattacks in the year so far, where “malicious or unwanted software” was disguised as popular online productivity tools. In April, Kaspersky — a cybersecurity company that provides antivirus and other security software for computers and mobile devices

Global cybersecurity company Kaspersky said on Wednesday that nearly 8,500 users from small and medium-sized businesses (SMBs) faced cyberattacks in the year so far, where “malicious or unwanted software” was disguised as popular online productivity tools.
In April, Kaspersky — a cybersecurity company that provides antivirus and other security software for computers and mobile devices — said that widespread adoption of artificial intelligence (AI) and machine learning technologies in recent years has provided “threat actors with sophisticated new tools to perpetrate attacks”…
Read More

Continue Reading
Antivirus

The best antivirus software of 2025: Stay safe from online attacks and ransomware scams

These antivirus tools can block online dangers, protect your data and shield your privacy and they are a lot cheaper than you think…

These antivirus tools can block online dangers, protect your data and shield your privacy and they are a lot cheaper than you think…
Read More

Continue Reading
Antivirus

Why This Budget-Friendly VPN & Antivirus Combo Is Blowing Up

If you’re looking to score a two-in-one deal, this discounted VPN + antivirus combo from Surfshark is sure to catch your eye…

If you’re looking to score a two-in-one deal, this discounted VPN + antivirus combo from Surfshark is sure to catch your eye…
Read More

Continue Reading