← Back to BrewedIntel
incidentmediumMalvertisingPhishing

Sep 25, 2025 • Alin MOLOCE

The Scam That Won’t Quit: Malicious “TradingView Premium” Ads Jump from Meta to Google and YouTube

Bitdefender Labs has identified a persistent malvertising campaign targeting users across Meta, Google, and YouTube platforms. Initially originating on...

Source
Bitdefender Labs
Category
incident
Severity
medium

Executive Summary

Bitdefender Labs has identified a persistent malvertising campaign targeting users across Meta, Google, and YouTube platforms. Initially originating on Facebook, the campaign lures victims with promises of free access to TradingView Premium and other financial services. These malicious advertisements redirect users to potentially harmful destinations, posing significant risks to both content creators and general users. While specific malware families or threat actor groups were not explicitly named in the provided text, the campaign's expansion indicates a sophisticated operation leveraging trusted advertising networks. The primary impact involves potential credential harvesting or financial fraud through deceptive landing pages. Users are advised to exercise caution when clicking on ads promising premium financial tools for free. Verification of ad legitimacy and utilizing ad blockers may mitigate exposure. Organizations should monitor traffic for unusual redirects associated with financial platform lures to prevent compromise within their networks.

Summary

Over the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms. According to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks. Unlike legitimate ads, these malicious campaigns redirect us

Published Analysis

Bitdefender Labs has identified a persistent malvertising campaign targeting users across Meta, Google, and YouTube platforms. Initially originating on Facebook, the campaign lures victims with promises of free access to TradingView Premium and other financial services. These malicious advertisements redirect users to potentially harmful destinations, posing significant risks to both content creators and general users. While specific malware families or threat actor groups were not explicitly named in the provided text, the campaign's expansion indicates a sophisticated operation leveraging trusted advertising networks. The primary impact involves potential credential harvesting or financial fraud through deceptive landing pages. Users are advised to exercise caution when clicking on ads promising premium financial tools for free. Verification of ad legitimacy and utilizing ad blockers may mitigate exposure. Organizations should monitor traffic for unusual redirects associated with financial platform lures to prevent compromise within their networks. Over the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms. According to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks. Unlike legitimate ads, these malicious campaigns redirect us Over the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms. According to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks. Unlike legitimate ads, these malicious campaigns redirect us