Hackers Exploit Facebook Ads to Target Crypto Users with Windows 11 Scam
Cybercriminals are deploying sophisticated malware through Facebook advertisements disguised as Windows 11 updates. The attack vector specifically targets cryptocurrency users, siphoning seed phrases, wallet credentials, and browser sessions. Malwarebytes researchers confirm the operation uses geofencing to evade detection, filtering out data center IPs while focusing on residential and corporate networks.
The campaign mimics Microsoft’s branding with cloned domains and SSL-certified payloads hosted on GitHub. A fake installer labeled *LunarApplication*—reminiscent of legitimate crypto tooling—bypasses virtual machine checks before compromising systems. The malware’s evasion tactics reflect growing precision in digital asset theft schemes.