Cybercriminals are abusing Meta’s advertising platforms with fake offers of a free TradingView Premium app that spreads the Brokewell malware for Android.

The campaign targets cryptocurrency assets and has been running since at least July 22nd through an estimated 75 localized ads.

Brokewell has been around since early 2024 and features a broad set of capabilities that include stealing sensitive data, remote monitoring and control of the compromised device.

Taking over the device

Researchers at cybersecurity company Bitdefender investigated the ads in the campaign, which use the TradingView branding and visuals and lure potential victims with the promise of a free premium app for Android.

They note that the campaign was specifically designed for mobile users, as accessing the ad from a different operating system would lead to harmless content.

Clicking from Android, however, redirected to a webpage mimicking the original TradingView site that provided a malicious tw-update.apk file hosted at tradiwiw[.]online/

“The dropped application asks for accessibility, and after receiving it, the screen is covered with a fake update prompt. In the background, the application is giving itself all the permissions it needs,” the researchers say in a report this week..

Furthermore, the malicious app also tries to obtain the PIN for unlocking the device by simulating an Android update request that needs the lockscreen password.

According to Bitdefender, the fake TradingView app is “an advanced version of the Brokewell malware” that comes “with a vast arsenal of tools designed to monitor, control, and steal sensitive information:”

• Scans for BTC, ETH, USDT, bank account numbers (IBANs)
• Steals and exports codes from Google Authenticator (2FA bypass)
• Steals account by overlaying fake login screens
• Records screens and keystrokes, steals cookies, activates the camera and microphone, and tracks the location
• Hijacks the default SMS app to intercept messages, including banking and 2FA codes
• Remote control – can receive commands over Tor or Websockets to send texts, place calls, uninstall apps, or even self-destruct

The researchers provide a technical overview of how the malware works and an extended list of supported commands that includes more than 130 rows.

Bitdefender says that this campaign is part of a larger operation that initially used Facebook ads impersonating “dozens of well-known brands” to target Windows users.

Threat actors have been using multiple websites promoted through Google ads to distribute a convincing PDF editing app that delivers an info-stealing malware called TamperedChef.

The campaign is part of a larger operation with multiple apps that can download each other, some of them tricking users into enrolling their system into residential proxies.

More than 50 domains have been identified to host deceiving apps signed with fraudulent certificates issued by at least four different companies.

The campaign appears to be widespread and well-orchestrated as the operators waited for the ads to run their course before activating the malicious components in the applications, researchers say.

Full update delivers infostealer

A technical analysis from cybersecurity services company Truesec describes the process of TamperedChef infostealer being delivered to a user’s system.

The researchers discovered that the malware was delivered through multiple websites that promoted a free tool called AppSuite PDF Editor.

Based on internet records, the investigators determined that the campaign started on June 26, when many of the websites involved were either registered or started to advertise AppSuite PDF Editor.

However, the researchers found that the malicious app had been verified through the VirusTotal malware scanning services on May 15th.

It appears that the program behaved normally until August 21st, when it received an update that activated malicious capabilities built to collect sensitive data like credentials and web cookies.

According to Truesec, TamperedChef infostealer is delivered with the “-fullupdate” argument for the PDF editor’s executable.

The malware checks for various security agents on the host. It also queries the databases of installed web browsers using the DPAPI (Data Protection Application Programming Interface) –  a component in Windows that encrypts sensitive data.

Digging deeper for the distribution method, Truesec researchers found evidence suggesting that the threat actor spreading TamperedChef within AppSuites PDF Editor relied on Google advertising to promote the malicious program.

The threat actor likely had a strategy to maximize the number of downloads before activating the malicious component in AppSuites PDF Editor, as they delivered the infostealer just four days before the typical expiration period of 60 days for a Google ad campaign.

Looking further into AppSuites PDF Editor, the researchers found that different versions of the program were signed by certificates “from at least four companies,” among them ECHO Infini SDN BHD, GLINT By J SDN. BHD, and SUMMIT NEXUS Holdings LLC, BHD.

Joining a residential proxy

Truesec found that the operator of this campaign has been active since at least August 2024 and promoted other tools, including OneStart and Epibrowser browsers.

It is worth noting that OneStart is usually flagged as a potentially unwanted program (PUP), which is typically the term for adware.

However, researchers at managed detection and response company Expel also investigated incidents involving AppSuites PDF Editor, ManualFinder, and OneStart, all “dropping highly suspicious files, executing unexpected commands, and turning hosts into residential proxies,” which is closer to malware-like behavior.

They found that OneStart can download AppSuite-PDF (signed by an ECHO INFINI SDN. BHD certificate), which can fetch  PDF Editor.

The code-signing certificates used in this campaign have already been revoked, but the risk is still present for current installations.

In some instances of PDF Editor, the app would show users a message asking for permission to use their device as a residential proxy in return for using the tool for free.

The researchers note that the proxy network provider may be a legitimate entity not involved in the campaign and that the operator of PDF Editor is capitalizing as affiliates.

It appears that whoever is behind PDF Editor is trying to maximize their profit at the expense of users worldwide.

Even if the programs in this campaign are considered PUPs, their capabilities are typical of malware and should be treated as such.

The researchers warn that the operation they uncovered involves more apps, some of them not yet weaponized, capable of distributing malware or suspicious files, or executing commands surreptitiously on the system.

Both reports from Truesec and Expel [1, 2] include a large set of indicators of compromise (IoCs) that could help defenders protect users and assets from getting infected.

Investors look to Warren Buffett for guidance because he’s proven he can weather any market storm. That’s even earned him the nickname the Oracle of Omaha (his hometown), as over time, he’s generally made just the right moves at just the right time. A recent example: Buffett sold positions in S&P 500 index funds in the fourth quarter, locking in gains before the benchmark went on to decline.

This top investor doesn’t look into a crystal ball when planning his moves, but instead considers key elements like valuation. And the index’s shift into one of its most expensive periods ever may have helped prompt him to hit the “sell” button on the Vanguard S&P 500 ETF and SPDR S&P 500 ETF Trust in the quarter.

Of course, Buffett isn’t one to stand up and comment on the situation with each market movement. But over the years, the billionaire has offered many thoughts on his strategy, the market, and investing in general. For example, we know he appreciates quality companies trading for reasonable prices; we also know he doesn’t go for trends, and favors holding stocks for the long term.

Over the years, Buffett has repeated one particular idea several times, in different ways. This resounding message to Wall Street couldn’t be clearer, and it may change the way you see the market and invest right now. Let’s listen in.

Image source: The Motley Fool.

A changing investing environment

First, though, let’s take a quick look at the recent investing environment. Stocks soared over the past two years on optimism about a lower-interest-rate environment ahead, and the potential of artificial intelligence (AI) to transform how work is done. Lower rates offer companies an easier path to growth — and AI has been seen as a technology that could unlock efficiency, cost savings, and more for companies.

All of this drove stocks to one of their most expensive levels ever as measured by the S&P 500 Shiller CAPE ratio, a metric that considers stock price and earnings over a 10-year period to adjust for shifts in the economy. It reached a level of 35, something it’s only done twice before since the S&P 500 launched as a 500-company index in the 1950s.

S&P 500 Shiller CAPE Ratio data by YCharts.

However, stocks have recently retreated on concerns that President Donald Trump’s tariffs on imports will hurt companies’ earnings and the general economy. The S&P 500 and Nasdaq Composite both slipped into correction territory earlier this month, though the S&P 500 has since exited the correction zone.

Two key Buffett quotes

Now let’s turn to Buffett’s message to Wall Street, one that he’s repeated over the years. Two quotes in particular express it:

“The best chance to deploy capital is when things are going down,” he once said. And, in a letter to shareholders in the 1980s, Buffett wrote that he and his team at Berkshire Hathaway aim to “be fearful when others are greedy and to be greedy only when others are fearful.”

This message is particularly interesting right now, amid market declines. You may be asking yourself whether now is really a good time to buy stocks — as stocks and indexes slip, investing may seem scary. What if you buy a stock today and it falls even more tomorrow?

But Buffett tells us that times like these are actually the best moments to get in on the market. Why is this? Because as stocks fall, so do their valuations. As a result, some of the recently beaten-down players will offer you wonderful opportunities. This is the time to “be greedy … when others are fearful.”

Cheap tech stocks

For example, well-established technology stocks with bright future prospects — such as Nvidia (NVDA -1.51%) and Meta Platforms (META -4.22%) — have seen their shares drop into bargain territory. Today, Nvidia trades for 25 times forward earnings estimates, and Meta for 24. These could be fantastic buys for growth investors.

And even if the stock you buy today falls further in the coming days, that’s OK. When you hold on for the long term — and that’s the best way to invest — near-term fluctuations won’t crush your returns.

So now you may be wondering if Buffett, too, has been buying stocks in recent days. The billionaire was a net seller of stocks last year as the market soared, but it’s too early to know what moves he’s been making since the start of 2025. We’ll have to wait for his 13F filing in May for that information.

That said, he isn’t known for making rash decisions or jumping into something on a whim — so we may not see a sharp turnaround, with Buffett scooping up stocks like hotcakes. His words don’t mean that he piles into stocks during every market downturn. They just mean that during these times, he expects to find more opportunities to get in on quality stocks at the right price than he would in soaring markets.

All of this may ease your mind as you watch the indexes fluctuate these days. Buffett’s words may inspire you to seize this moment, and instead of fleeing the market, to look for smart buys that may boost your portfolio over time.

Optical and photonics component seller Lumentum Holdings (LITE -0.58%) delivered an outstanding performance on the stock market last year, registering healthy gains of 61% as investors took note of the growing impact of artificial intelligence (AI) on the company’s business, and it looks like the stock’s red-hot run is here to stay in 2025.

Lumentum released fiscal 2025 second-quarter results (for the three months ended Dec. 28, 2024) on Feb. 6. The company’s growth trajectory continued improving during the quarter thanks to the robust performance of its cloud and networking business. It is worth noting that Lumentum finished fiscal 2024 on a sour note, as the weak demand for its optical components in the industrial segment and from telecom providers led to a sharp decline in its revenue and earnings.

However, fiscal 2025 is turning out to be a much better year for the company as the demand for its optical components deployed in AI servers for high-speed data transmission is growing rapidly. Let’s examine Lumentum’s latest results and check why this company has room for more upside.

Lumentum’s AI-driven growth is just getting started

Lumentum reported a 10% year-over-year increase in its fiscal Q2 revenue to $402 million, driven mainly by the AI-powered demand for its components in the cloud and networking business. More specifically, the cloud and networking segment’s revenue increased 18% from the year-ago period, offsetting the 21% drop in the industrial business.

The cloud and networking business now accounts for 84% of Lumentum’s top line, and the growing influence of this segment on Lumentum’s top line should pave the way for stronger growth going forward. This explains why the midpoint of Lumentum’s fiscal Q3 guidance of $417.5 million would translate into a 14% jump from the year-ago period.

Lumentum management points out that it is witnessing healthy demand from hyperscale cloud customers. More specifically, the demand from its largest hyperscale customer increased during the quarter, and it started volume shipments to a new customer. Even better, Lumentum’s components are in the qualification phase at another customer. Management estimates that it will begin volume shipments to this new customer in fiscal Q4.

The good part is that the demand for Lumentum’s components used in data centers is so strong that the company is increasing its manufacturing capacity. So, it won’t be surprising to see Lumentum’s growth indeed picking up as the year progresses. Analysts are forecasting the company to end the year with an 18% increase in revenue to $1.6 billion, followed by healthy growth over the next couple of years as well.

LITE Revenue Estimates for Next Fiscal Year data by YCharts

Lumentum management points out that its “engagement with cloud customers and AI infrastructure providers on their long-term technology and product roadmap has reached an all-time high.” The shipments of its externally modulated lasers (EMLs), which enable high-speed data transmission with the help of fiber-optic cables, hit a record last quarter thanks to AI-related demand.

Looking ahead, Lumentum’s EML shipments are likely to head higher as it expects to gain more market share on account of new design wins for AI applications. What’s more, the data center interconnect (DCI) market that Lumentum is targeting is expected to grow by 71% over the next four years, according to one estimate, with AI set to play a central role in this market’s healthy growth. So, Lumentum could be at the beginning of a terrific long-term growth opportunity.

Strong earnings growth could lead to impressive stock price upside

Another thing worth noting is that Lumentum’s margins are getting better on account of higher manufacturing utilization and its focus on keeping costs under check. As a result, Lumentum’s non-GAAP (adjusted) operating margin jumped by six percentage points year over year in the previous quarter. This led to stronger growth of 75% in the company’s bottom line last quarter to $0.42 per share.

Consensus estimates are projecting a 73% increase in the company’s bottom line this year to $1.75 per share, followed by outstanding growth over the next two years as well.

LITE EPS Estimates for Next Fiscal Year data by YCharts

Assuming Lumentum could hit $4.74 per share in earnings in fiscal 2027 and trades at 27.6 times earnings at that time (in line with the tech-laden Nasdaq-100 index’s forward earnings multiple), its stock price could hit $131 in just over two years. That would be a 60% jump from current levels, suggesting that this AI stock has the potential to fly higher even after clocking impressive gains last year.