10 Million Users Caught in Crypto Trap as 35,000 Ads Spread Undetectable Malware Through Trusted App Imitations – Did You Click One?

10 Million People Exposed To Fake Crypto App Ads In Silent Global Malware Operation

A stealth malware campaign imitating nearly 50 popular cryptocurrency platforms has exposed over 10 million people worldwide, cybersecurity firm Check Point Research has revealed.

The campaign, dubbed JSCEAL, has been silently operating since at least March 2024 and continues to expand, relying on deceptive advertisements to lure unsuspecting users into downloading malware-laced crypto apps.

Fake Apps Disguised As Binance And MetaMask Flood Online Ads

Check Point found that the malware disguises itself behind lookalike interfaces of widely used platforms such as Binance, MetaMask, and Kraken.

Victims are tricked into clicking online ads that lead to realistic-looking websites, where they unknowingly install malicious software.

Once downloaded, the malware collects sensitive user information in the background, all while mimicking the behaviour of legitimate apps to avoid raising suspicion.

In many cases, the fake app launches the actual crypto platform’s interface, adding to the illusion that nothing is amiss.

But behind the scenes, it siphons data including keystrokes, Telegram login credentials, browser cookies, and saved autofill information—posing serious risks to users’ crypto wallets and personal security.

Source: Check Point

JavaScript-Powered Malware Built To Avoid Detection

Unlike typical malware, JSCEAL relies on JavaScript, a web-based programming language that doesn’t need user interaction to activate.

Its behaviour is heavily concealed using compiled code and complex obfuscation techniques, making it extremely difficult to detect.

Check Point described the malware as employing “unique anti-evasion methods,” which helped it remain hidden for more than a year.

Analysts said that the malware's structure—where the fake installer and the legitimate-looking app run simultaneously—makes it nearly impossible to analyse each component in isolation.

Social Media Ads Help Spread Over 35,000 Malicious Campaigns

Meta’s ad systems revealed that more than 35,000 malicious ads were distributed during the first half of 2025 alone, contributing to millions of views, particularly in regions with high crypto and social media activity.

Malicious ads on Facebook (Source: Check Point)

The campaign was especially widespread across the European Union and Asia, with at least 3.5 million users in the EU estimated to have seen the fake promotions.

The total number of infected users remains unclear, as ad impressions don’t equate directly to malware installations.

However, Check Point warns that the actual impact may be “much higher than initial estimates” due to the campaign’s scale and level of sophistication.

Malware Targets Browser Extensions And Crypto Credentials

One of the most dangerous elements of JSCEAL is its ability to tamper with crypto-related browser extensions, particularly MetaMask.

Once installed, the malware can manipulate these tools to intercept or even redirect crypto transactions.

It also lifts stored login data from browsers, exposing bank information and personal credentials.

The malware is designed to collect as much device and user data as possible.

Experts believe that stolen information is transmitted to unknown threat actors, likely aiming to monetise the data or drain victims' crypto wallets.

Researchers Call For Stronger Ad Oversight

Concerns are mounting over the role of digital ad platforms in the spread of malware, a problem underscored by the recent incident.

Check Point’s researchers stressed the need for better monitoring of ad systems to prevent such large-scale abuse.

They also urged crypto users to remain cautious when downloading apps, recommending the use of verified app stores and security software capable of detecting malicious JavaScript behaviour.

The firm warned that crypto holders, in particular, face a higher risk due to the difficulty of recovering stolen assets and tracing perpetrators within anonymous blockchain ecosystems.

“The global reach could easily exceed 10 million.”