Microsoft Warns of Malvertising Campaign Targeting Crypto Traders

Microsoft Threat Intelligence has issued a critical alert about a widespread "malvertising" campaign targeting cryptocurrency traders. The malicious operation, which began earlier this month, uses fake advertisements to trick users into downloading malware disguised as popular crypto trading tools, including those from Binance and TradingView.

Once downloaded, the installer deploys a Node.js-based malware that stealthily infects the user's system. The malware collects sensitive data—such as BIOS version, region settings, network adapter information, and installed programs—while also creating a hidden scheduled task to ensure persistence and evade antivirus detection. Victims are then shown a legitimate-looking interface to mask the infection.

Microsoft emphasized the risks of downloading software from unverified sources, warning that the collected data could be used for targeted cyberattacks. To safeguard against this threat, users and organizations are urged to enable endpoint protection, restrict outbound communications, and closely monitor Node.js script behavior. Limiting Node.js execution on systems can further minimize potential impact.

This alert highlights growing cybersecurity concerns within the crypto space. In a related note from last year, CryptoQuant CEO Ki Young Ju warned that Windows operating systems may pose greater risks for crypto holders than macOS.

Microsoft’s latest warning serves as a reminder for traders and investors to remain vigilant and ensure all software is obtained from trusted sources. With crypto-related cyberattacks on the rise, proactive security measures are essential to protecting digital assets and personal information.