This March, Malvertisers have been found out once again escalating their Github Deepfakes and Facebook Malware tactics: Targeting 1 Million Window users through illegal streaming sites; using Deepfake Twins and Romance Bots to mislead lonely people online and mimic employees’ personality to compromise businesses; and Facebook scams have increased by 12%! We tell you all about each scam and how to block it in your website or Ad Network in the following lines.

GitHub Hosted Malware attacks 1 million Windows users

InfoStealer Malware (Lumma and Doenerium Stealer Payloads) has been spread to nearly 1 million Windows users via a broad reach Malvertising campaign. The threat actor has used GitHub, Dropbox and Discord to host the Malware, and illegal streaming platforms (movies7.net and 0123movie.art) to propagate the attack. The attack was directed both to consumers and to enterprise devices across several industries and organizations. Microsoft researchers found out that the malware redirectors were embedded within video frames to generate pay-per-view or pay-per-click revenue on illegal streaming websites. Upon end users clicking, they were then sent to GitHub, then the Malware was deployed.

“Once the initial malware from GitHub gained a foothold on the device, the additional files deployed had a modular and multistage approach to payload delivery, execution, and persistence,” according to Microsoft Threat Intelligence (MTI). “The files were used to collect system information and to set up further malware and scripts to exfiltrate documents and data from the compromised host.”

Microsoft identified the threat actors as a group name Storm-0408, known for attacks that use Phishing, SEO and Malvertising Campaigns as the initial process to distribute malicious payloads and access end user devices remotely. The campaign is most likely part of a broader Malware-as-a-service (MaaS) ecosystem, where Malvertisers use prebuilt kits to launch their attacks. Are you wondering how to detect malicious redirects and block scams? Get in touch with out team now and learn how to block Github Deepfakes and Facebook Malware!

Deepfake Digital Twins and Romance bots malvertising rise cybersecurity concerns

End users are being lured into fake romantic relationships and scammed their money by AI-powered chatbots. Deepfake digital twins are also being used for scams or to hijack business’ and government agencies’ security. These tactics are being used to launch “pig butchering scams”, which involves targeting lonely people in online relationships or investment opportunities, then stealing their money (“butchering” them), often through fake crypto investments.

While these scams are far from new, the use of IA has taken them to a whole new level, not even needing a person to interact with the unsuspecting victims. Instead, they just have an AI do it. After a victim has been lured in by the AI, scammers then pass them off to human operators, who can chat via the “personality filter” of the AI being used. Then, they will start asking them to partake in scam investments.

When it comes to Deepfake Digital Twins, these malicious attacks use breached or leaked personal information to train an AI model to mimic the personality and knowledge of the person whose information got stolen. “When deployed with deepfake video/audio and compromised biometric data, they could be used to convince identity fraud or ‘honeytrap’ a friend, colleague, or family member,” the company said in its cybersecurity briefer. This terrifying tactic could be used in large-scale attacks targeting specific employees to compromise full businesses.

Both these attacks can be perpetrated through Malvertising, where a very realistic ad is crafted by AI. End users click the link, and then suddenly Malware or Identity Theft Hell unveils! This Malvertising scams highlights the need to work with specialized ad security software tools designed to block any Malvertising attempt from your ad supply chain.

Facebook Malvertising is on the rise and advertisers must verify their identities

Due to a recent 12% rise in Facebook Malvertising, Facebook Advertisers will be required to verify their identities by the end of June, by uploading their government-issued ID. The rise in Malvertising was detected in reports about scam advertising on Facebook in a pilot test run from June to December 2024. During that period, the Ministry of Home Affairs (MHA) had allowed Facebook to apply the verification requirement only on selected advertisers, but if scams continued to increase, MHA would tighten security measures.

Under the new E-Commerce Services Code of Practice, effective June 2024, platforms like Facebook and Carousell must implement measures to protect Singapore users from scams. From June to December 2024, they were only required to verify the identities of “risky” sellers. On March 10, MHA reported that Facebook failed to reduce scam advertisements in the second half of 2024, particularly those appearing in posts across the platform. The ministry also highlighted that Meta’s verification process only applied to paid ads, while police data on scam ads includes both paid and unpaid posts.

Therefore, Meta will not verify the identity of all advertisers on Facebook by the end of June 2025, with the Ministry monitoring the situation. Failure to comply with this new Code is a criminal offence under the Online Criminal Harms Act. If found guilty, Malvertisers could be fined up to $1 million under the Act, which came into effect in February 2024.

Conclusion: Block Github Deepfakes and Facebook Malware

As we can see above, the Malvertising landscape continues to evolve. Malvertisers continue to raise the profile of their malicious strategies to continue bypassing detection, further infecting end user devices, stealing sensitive information and compromising businesses. This is why it becomes the responsibility of online stakeholders to protect end users from their malicious influence, finding software that scans all elements of the ad supply chain. If you own an Ad Network or a website which you want to protect against their Malvertising tactics, get in touch with our team now: We will tell you all about how AdSecure’s Malvertising Prevention & Ad Quality Solution will keep your ad supply chain clean and end users safe at all times. Get in touch with our team to find out more on how to block Github Deepfakes and Facebook Malware, or why not try our software for free for 14 days?** **