Brokewell malware Archives

Tech Optimizer

September 26, 2025

Malware Campaign Spreads Trojans via Hijacked Ads on Facebook, Google, YouTube

A recent malware campaign has transitioned from Meta’s advertising ecosystem to Google Ads and YouTube, initially targeting Facebook users through compromised business accounts. The threat originated from a Norwegian design agency’s hijacked Facebook Business account, promoting fraudulent ads for a fictitious “TradingView Premium” app that directed users to download malware. The malware is disseminated on YouTube through hijacked verified channels, leading victims to a downloader that installs Trojan.Agent.GOSL, capable of data theft and remote device control. Over 250 malicious apps targeting Android devices have been identified, equipped for credential theft and unauthorized access. Attackers compromise verified accounts to bypass scrutiny, altering page names to mimic official entities. The campaign exploits vulnerabilities in both Meta's and Google’s ad networks, utilizing OAuth URLs and ad placements to evade detection. Security experts recommend multi-layered defenses, enabling two-factor authentication, and verifying app sources to mitigate risks.

AppWizard

September 2, 2025

Crooks exploit Meta malvertising to target Android users with Brokewell

Cybercriminals are using Meta's advertising platform to spread the Brokewell malware, targeting Android users through deceptive promotions, particularly fake TradingView Premium ads since July 2024. Over 75 counterfeit ads have been identified, leading users to download a trojanized .apk file from cloned websites. Once installed, the app requests accessibility permissions and disguises itself with fake update notifications, ultimately deploying Brokewell, a spyware and Remote Access Trojan (RAT) that conducts extensive surveillance and data theft, primarily targeting users in the European Union. Brokewell employs obfuscation techniques and native libraries to hide its code, featuring a JSON configuration for overlaying legitimate applications and a decrypted .dex file for its main payload. It communicates with command and control servers via Tor and WebSocket, enabling various espionage activities, including crypto theft, 2FA bypass, account takeover, surveillance, SMS interception, and remote control of the device. Experts recommend that users only install apps from official app stores, avoid suspicious ads, verify URLs before downloading software, and review app permissions carefully. The risks associated with compromised devices are significant, especially as mobile banking and cryptocurrency wallets become more common.

AppWizard

May 2, 2024

Warning Against New Brokewell Android Malware That Spreads Through Fake Chrome Update, Targets Banking Apps

The Brokewell malware is a new cyber threat targeting Android users, disguised as a fake Chrome update. It can infiltrate banking applications, create overlay screens to steal login credentials, and bypass multi-factor authentication systems. Users are advised to be cautious of unsolicited software updates and download apps only from reputable sources.

AppWizard

April 29, 2024

Android malware posing as a fake Chrome update is stealing banking app logins

A new Android malware named Brokewell is masquerading as an update for Google Chrome, distributed through a counterfeit browser update page. It uses overlay attacks to steal user credentials and cookies, as well as employs accessibility logging to capture all actions on the infected device. Once cybercriminals have gathered enough private data, they can exploit the malware's remote control features to carry out unauthorized activities on the device.