Cybercriminals are abusing Meta’s advertising platforms with fake offers of a free TradingView Premium app that spreads the Brokewell malware for Android. The campaign targets cryptocurrency assets and has been running since at least July 22nd through an estimated 75 localized ads. Brokewell has been around since early 2024 and features a broad set of capabilities that include stealing sensitive data, remote monitoring and control of the compromised device. Researchers at cybersecurity company Bitdefender investigated the ads in the campaign, which use the TradingView branding and visuals and lure potential victims with the promise of a free premium app for Android. They note that the campaign was specifically designed for mobile users, as accessing the ad from a different operating system would lead to harmless content. Clicking from Android, however, redirected to a webpage mimicking the original TradingView site that provided a malicious tw-update.apk file hosted at tradiwiw[.]online/ “The dropped application asks for accessibility, and after receiving it, the screen is covered with a fake update prompt. In the background, the application is giving itself all the permissions it needs,” the researchers say in a report this week.. Furthermore, the malicious app also tries to obtain the PIN for unlocking the device by simulating an Android update request that needs the lockscreen password. According to Bitdefender, the fake TradingView app is “an advanced version of the Brok...
Brokewell Android malware delivered through fake TradingView ads
BleepingComputer
·Ionut Ilascu
·Published Aug 31, 2025
·Updated
Affected Software
2 affected components
Meta advertising platforms
TradingView Premium app=Android
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the Brokewell Android malware being spread through fake ads for a free TradingView Premium app on Meta's advertising platforms.
2
What security implications are discussed in the article?
The implications include the risk of malware infection targeting cryptocurrency assets via deceptive advertisements.
3
What products or software are affected by the malware campaign?
The affected products include the Android version of the TradingView Premium app and Meta's advertising platforms.
4
Who is targeted by the Brokewell malware campaign?
The campaign primarily targets cryptocurrency investors through fraudulent offers.
5
How are the cybercriminals delivering the Brokewell malware?
The malware is being delivered through fake ads that promise access to a free Premium version of the TradingView app.