The service, referred to as 1Campaign, provides hackers with a one-stop-shop for running malicious ads and enabling fraud "at scale," a recent report by cybersecurity company Varonis uncovered. Using just a single dashboard, hackers can cloak malicious content from security researchers, ad platform reviewers, and automated scanners - who instead see a benign white page - and target general users with phishing or scam attempts.
GeoEdge, the global authority in ad security and user protection, today (18th November, 2025) announced the launch of User Safety Now, a global initiative urging the adoption of a universal safety standard for digital advertising. The initiative follows GeoEdge's warning to regulators and digital media industry leaders that the internet is confronting a mounting user-safety crisis. In 2025, GeoEdge found that 1 in every 40 programmatic impressions in North America carried malicious intent designed to defraud users.
The current infection chain is built on a highly successful malvertising model. Threat actors buy Bing search engine advertisements to direct users to convincing-looking, but malicious landing pages," said Aaron Walton, threat intelligence analyst at Expel. "These search engine ads put links to the download right in front of potential victims. The most recent campaigns push ads for Microsoft Teams and impersonate the download pages. However, they've also cycled through other popular software such as PuTTy and Zoom.
Bitdefender warns that a Meta malvertising campaign has expanded to Android phones. The research discovered malicious ads that offer a free TradingView Premium app for Android. Rather than leading users to a legitimate software, however, these ads take victims to a sophisticated crypto-stealing trojan, which the research as "an evolved version of the Brokewell malware." The research's most recent analysis revealed the campaign remains active and has leveraged at least 75 malicious ads since mid-July.
Upon execution, a backdoor known as Oyster/Broomstick is installed. Persistence is established by creating a scheduled task that runs every three minutes, executing a malicious DLL (twain_96.dll) via rundll32.exe using the DllRegisterServer export.