Cybercriminals have launched a sophisticated campaign exploiting Facebook’s advertising platform to distribute malware and steal cryptocurrency wallet credentials, targeting users worldwide through deceptive Pi Network-themed advertisements. These malicious advertisements masquerade as official Pi Network promotions, offering fake mining applications and fraudulent wallet access portals that promise users substantial cryptocurrency rewards. The attack campaign demonstrates a coordinated effort by threat actors who have weaponized legitimate social media advertising mechanisms to deliver multi-stage malware payloads. However, the software packages contain malicious payloads identified as Generic.MSIL.WMITask and Generic.JS.WMITask variants, representing multi-stage malware previously analyzed by Bitdefender’s security team in May 2025. The first involves phishing pages that meticulously mimic legitimate Pi Wallet interfaces, prompting users to enter their 24-word recovery phrases under the pretense of claiming 628 Pi tokens or participating in exclusive airdrop events. The malware’s persistence mechanisms ensure continued operation even after system reboots, while its communication modules establish connections with command-and-control infrastructure to exfiltrate stolen data and download additional malicious components. By leveraging Facebook’s advertising legitimacy and Pi Network’s growing popularity, threat actors have created an effective distribution mechanism that continues to evolve and adapt to security countermeasures. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The primary payload focuses on credential harvesting, systematically extracting saved passwords, authentication tokens, and cryptocurrency wallet keys from infected systems. The campaign’s success stems from exploiting users’ trust in verified social media platforms and their limited understanding of cryptocurrency security practices. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Simultaneously, the malware deploys keylogging capabilities to capture real-time user input, including newly entered passwords, recovery phrases, and sensitive financial information. The malicious operation, which began on June 24, 2025, coincides with the Pi2Day celebration and has already deployed over 140 ad variations to maximize its reach across multiple continents. Bitdefender researchers identified the second attack vector as malware-embedded applications disguised as Pi Network mining software. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 30 Jun 2025 13:25:14 +0000