Meta Ad Network Weaponized for Cross-Platform Crypto-Stealer Distribution
Threat actors are exploiting the Meta advertising ecosystem to execute sophisticated malvertising campaigns targeting macOS and Android users globally. By masquerading as legitimate software through trusted Meta ad placements, attackers bypass traditional web-based security perimeters to deliver the MacSync Stealer RAT on macOS and specialized Android-based APKs. These payloads utilize wallet-searching scripts and credential harvesters to identify and exfiltrate cryptocurrency wallets, private keys, and sensitive credentials to attacker-controlled Command and Control (C2) infrastructure. This campaign represents a significant escalation in leveraging high-trust advertising platforms to facilitate large-scale financial theft through cross-platform exploitation.