A new wave of fake TradingView ads is now targeting YouTube users through Google Ads, further escalating a dangerous malvertising campaign. Security experts warn that the scheme, which initially began on Meta platforms, is now putting more Android users at serious risk.
The campaign was first flagged by Bitdefender when researchers discovered a fake “TradingView Premium” app promoted through a hacked Facebook Business account belonging to a Norwegian design agency. At least 75 malicious ads were run, tricking users into downloading the Brokewell malware. This malware can steal login details, intercept cookies, track swipes and taps, and even record audio or capture location data. In advanced forms, Brokewell can act as a remote access trojan (RAT), granting hackers full control of a device.
Now, the campaign has expanded to YouTube. Hackers hijacked a legitimate YouTube channel, rebranded it to look like TradingView’s official account, and uploaded unlisted videos promoting the fake app. One such video gathered over 180,000 views in just a few days. Unlike Meta’s version, the YouTube campaign installs a Trojan.Agent.GOSL (also called JSCEAL or WeevilProxy) via a custom downloader.
While the full scale of victims remains unclear, experts are urging caution. Users should avoid downloading apps from third-party links, verify official sources, and be wary of ads offering free or premium versions of popular apps. Suspicious ads must be reported to Google or YouTube.
TradingView is a widely trusted platform for traders, which makes it an attractive target for cybercriminals. This growing campaign highlights the importance of vigilance — if an ad looks too good to be true, it likely is. Only downloading from official sources remains the strongest safeguard against such threats.
