Cybercriminals are abusing Meta’s advertising platforms with fake offers of a free TradingView Premium app that spreads the Brokewell malware for Android.

The campaign targets cryptocurrency assets and has been running since at least July 22nd through an estimated 75 localized ads.

Brokewell has been around since early 2024 and features a broad set of capabilities that include stealing sensitive data, remote monitoring and control of the compromised device.

Taking over the device

Researchers at cybersecurity company Bitdefender investigated the ads in the campaign, which use the TradingView branding and visuals and lure potential victims with the promise of a free premium app for Android.

They note that the campaign was specifically designed for mobile users, as accessing the ad from a different operating system would lead to harmless content.

Clicking from Android, however, redirected to a webpage mimicking the original TradingView site that provided a malicious tw-update.apk file hosted at tradiwiw[.]online/

“The dropped application asks for accessibility, and after receiving it, the screen is covered with a fake update prompt. In the background, the application is giving itself all the permissions it needs,” the researchers say in a report this week..

Furthermore, the malicious app also tries to obtain the PIN for unlocking the device by simulating an Android update request that needs the lockscreen password.

According to Bitdefender, the fake TradingView app is “an advanced version of the Brokewell malware” that comes “with a vast arsenal of tools designed to monitor, control, and steal sensitive information:”

• Scans for BTC, ETH, USDT, bank account numbers (IBANs)
• Steals and exports codes from Google Authenticator (2FA bypass)
• Steals account by overlaying fake login screens
• Records screens and keystrokes, steals cookies, activates the camera and microphone, and tracks the location
• Hijacks the default SMS app to intercept messages, including banking and 2FA codes
• Remote control – can receive commands over Tor or Websockets to send texts, place calls, uninstall apps, or even self-destruct

The researchers provide a technical overview of how the malware works and an extended list of supported commands that includes more than 130 rows.

Bitdefender says that this campaign is part of a larger operation that initially used Facebook ads impersonating “dozens of well-known brands” to target Windows users.

Europol has confirmed that a Telegram channel impersonating the agency and offering a $50,000 reward for information on two Qilin ransomware administrators is fake. The impostor later admitted it was created to troll researchers and journalists.

“We were also surprised to see this story gaining traction,” Europol told BleepingComputer on Monday. “The announcement didn’t come from us.”

The statement comes after a new Telegram channel called @europolcti was created on August 16th, claiming to offer a $50,000 reward for information on two Qilin ransomware admins known as “Haise” and “XORacle”.

“During the course of ongoing international investigations, we have confirmed that the cybercriminal group Qilin has carried out ransomware attacks worldwide, severely disrupting critical infrastructure and causing significant financial losses,” reads the imposter’s Telegram post.

“We have identified two primary administrators operating under the aliases Haise and XORacle, who coordinate affiliates and oversee extortion activities.”

“We are actively pursuing all available leads in cooperation with international partners.”

“A reward of up to $50,000 is offered for information that directly leads to the identification or location of these administrators.”

Haise is believed to be one of the operators of the Qilian ransomware gang, previously recruiting affiliates on the RAMP cybercrime forum.

The Qilin ransomware operation was initially launched as “Agenda” in August 2022. However, by September that year, it had rebranded under the name Qilin, which it continues to use to this day.

The ransomware operation is one of the most active, currently targeting companies worldwide.

However, after Europol confirmed it was fake, a new post appeared on the imposter channel claiming it was created to troll researchers and journalists, some of whom wrote articles about the claims.

“This was so easy to run and fool so called ‘Researchers’ and ‘Journalists’ that just copy stuff.. Thank you all!,” reads the new post.

The post was signed by Rey, a hacker previously linked to breaches at Telefonica and Orange Group.

Threat actors had begun trolling Qilin in August 15th posts on a Telegram channel impersonating threat actors from “Scattered Spider”, “ShinyHunters”, and “Lapsus,” where someone had begun calling out Haise and the ransomware operation.

This is not the first time threat actors attempted to mislead the media about cybercrime.

In 2021, a RAMP admin known as ‘Orange’ or ‘boriselcin’ and who ran the “Groove” ransomware site, called on threat actors to attack the USA. This threat actor was later sanctioned by the US for his involvement in three ransomware operations that targeted victims across the United States.

After the media covered this post, including BleepingComputer, the threat actor claimed it was fake and was created to troll and manipulate the media and security researchers.

However, security researchers from McAfee and Intel 471 believe that it was likely the threat actor trying to cover up for a failed ransomware-as-a-service.

In 2023, BleepingComputer receieved a “tip” about an alleged arrest of two Canadian teens over a crypto-theft attack.

While BleepingComputer learned that the news was fake and did not cover the story, we were told it was done to manipulate the media and “troll” the people accused of the theft.

An equestrian coach reportedly lost thousands after falling victim to a spoofing scam that offered to protect her bank account from fraud.

NBC 7 in San Diego reports that in June, Alixe Garcia received a text asking her if she authorized a large purchase at Best Buy.

Garcia received a call after texting back “no”.  She says she trusted the call the moment she answered the phone because the caller ID showed it was from a Wells Fargo customer service number.

Garcia says that during the 41-minute call, it sounded as if she was talking with someone who was able to view her accounts. She ended up transferring $5,700 to Apple Cash, believing that the money would be deposited into her new Wells Fargo account that the caller supposedly helped her create.

Thirty minutes later, when she logged in, the money was not there.

“I waited another 30 minutes. I’m, like, ‘Maybe it’s a little slow.’ No money. Then I was just, like, sick thinking about it.” 

She called the bank the next morning, but the agent told her that the person she was talking to was not from the bank.

Her money is also gone. Wells Fargo says that its security controls were functioning as intended, and Garcia ultimately authorized the transfers.

The bank warns consumers that if they get a similar call asking them to send a payment, transfer funds or send their physical cards to stop fraud in their account, they should immediately hang up and call their bank directly.

“Safeguarding our customers’ assets is our top priority, and we are actively working to raise awareness of common scams through various resources and ongoing education. We have robust security measures in place and conduct thorough investigations of fraud and scam reports before making claim decisions.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Featured Image: Shutterstock/Brazhyk

Key takeaways

• Pump-and-dump schemes in Web3 manipulate a cryptocurrency’s price through coordinated buying along with misleading information and hype to lure investors in before a mass selling of a token, leaving it almost worthless.

• Decentralized anonymity and 24/7 unregulated trading make the industry particularly vulnerable to these manipulative investment schemes.

• A pump-and-dump follows four stages, including the token prelaunch, promotional hype building at launch, price pumping through buying action and a coordinated sell-off by orchestrators running off with profits. 

• You can protect yourself from falling for pump-and-dumps by avoiding unsolicited investment advice, being skeptical of social media ads and avoiding schemes with promises of unrealistic returns in short time frames. 

Coordinated pump-and-dump schemes have dogged the Web3 ecosystem and crypto market for years. Often described as the Wild West of the digital world, the allure of quick profits has always attracted those looking to manipulate investments at the expense of others who believe unrealistic promises. 

With regulations continually playing catch-up, combined with the decentralized design of the industry, these schemes have often gone under the radar for law enforcement. Still, recent efforts show that Web3 is no longer impervious to regulators. For example, in October 2024, Operation Token Mirrors resulted in $25 million being seized and 18 people being charged. 

In this article, you’ll learn about “pump-and-dump schemes,” including their definition, how they operate and how to protect yourself from these sophisticated manipulation tactics. 

What are pump-and-dump schemes in Web3?

A pump-and-dump scheme refers to the intentional manipulation of a cryptocurrency or blockchain asset’s price. The market price of these digital assets is achieved through coordinated buying coupled with misleading information. 

Once the scheme ringleaders achieve their desired price, they initiate a violent sell-off to take their profits. This results in all other investors sitting on severely devalued or worthless tokens. The phrase refers to this process of “pumping up” a token’s price, then “dumping” the token and the price concurrently. As these assets generally have little to no value, the price never recovers, and innocent investors are stuck. 

Why do pump-and-dump schemes work in Web3?

The peer-to-peer decentralized design of Web3 makes it a fertile ground for this type of market manipulation. Often, token creators and project developers hide behind internet anonymity and use privacy-focused communication channels like Telegram. This makes it difficult for investors and authorities to hold schemers accountable for their deception.

Additionally, markets are tradeable 24/7 without concrete regulatory oversight or circuit breakers. Easy token creation on platforms like Pump.fun, which saw over 1 million tokens launched in 2024, further exacerbates the problem. 

Did you know? The insiders of a pump-and-dump scheme regularly net profits of over 100% and in the top cases, over 2,000% in a single event. 

How pump-and-dumps work in Web3

Web3 pump-and-dump schemes tend to follow four stages: pre-launch, launch, pump, and dump.

1. Pre-launch: To kick things off, hype is built around a new or relatively low-valued token. This is done using strategies like pre-sales and community building on platforms like Telegram, Discord and X. 

2. Launch: Promotion ramps up a new level, often including promoters like unsuspecting influencers to widen awareness and attract more excited investors. 

3. Pump: Misleading or fake news is spread through the community about potential big price increases or business partnerships. This skyrockets the market price of the token as people invest increasing amounts while pushing demand through the roof. 

4. Dump: When the Web3 token price manipulation reaches an attractively profitable level for the orchestrators, they sell off their holdings in large amounts. The huge sell-off causes the token’s supply to massively exceed demand and drop prices. Investors left holding tokens cannot sell before the token value is almost completely wiped out.

Did you know? Some coins can be targets of repeated pump-and-dump attacks. According to a study from the University of Bristol, the most attacked coin was targeted 98 times over a four-year period. 

Staying safe and spotting pump schemes in crypto

It can be difficult to distinguish Web3 trading manipulation tactics from an enthusiastic and legitimate investment opportunity. The potential rewards from getting in early on the next big legitimate crypto token provide perfect cover for the illegitimate decentralized pump-and-dump operators. 

Here’s how to spot potential fraud and coordinated crypto pump groups:

• Avoid unknown investment advice: If a stranger contacts you on social media or a messaging app and quickly turns the conversation into a “sure thing” investment, then be wary. It’s best to be cautious and not engage. 

• Crypto social media ads: Social media platforms have been plagued with investment ads that promise high returns. They might appear like legitimate companies or even use fake media to fool investors. Be particularly wary of high-profile celebrities who appear to be promoting Web3 projects. Often, manipulators create deepfakes of well-known names without their permission or backing.

• Do your own research: Don’t fall for pressurized investment opportunities where it’s a “now or never” chance to invest. Always take your time to research projects. You should find out about the founders, developers, track record and company information. If this is obscure or insufficient, then it’s best to avoid investing. 

• Spread your risk: Be vigilant for investment promises of high returns for little risk in a short timeframe. Certainly, don’t commit the majority of your funds to any single investment; instead, diversify your funds to spread the risk and rescue losses on any investments that go wrong in the event of crypto market manipulation in Web3.

This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.