Nearly 1 million Windows devices targeted in advanced “malvertising” spree

image via Ars Technica

March 7, 2025, 8:23 PM

• •The campaign began in December and targeted nearly 1 million Windows devices.
• •The malware was loaded in four stages and collected device information, disabled malware detection apps, and connected to command-and-control servers.
• •The malware targeted browser files, files stored on Microsoft's OneDrive cloud service, and cryptocurrency wallets.

Nearly 1 million Windows devices were targeted in recent months by a sophisticated "malvertising" campaign that surreptitiously stole login credentials, cryptocurrency, and other sensitive information from infected machines. The campaign began in December, when the attackers, who remain unknown, seeded websites with links that downloaded ads from malicious servers. The links led targeted machines through several intermediary sites until finally arriving at repositories on Microsoft-owned GitHub, which hosted a raft of malicious files.

Read original article