According to Cointelegraph, Check Point research shows that a malicious software operation codenamed "JSCEAL" is impersonating nearly 50 commonly used cryptocurrency trading applications worldwide, including Binance, MetaMask, and Kraken. This activity has been active since March 2024, inducing users to download fake applications containing malicious software through the placement of malicious advertisements.
Research shows that by the first half of 2025, 35000 malicious advertisements have been placed, affecting millions of users in the EU region alone. This malicious software uses unique anti detection technology to collect sensitive data such as user keyboard input, Telegram account information, and automatic password filling, and can manipulate cryptocurrency related browser plugins. Experts suggest that using anti malware software that can detect malicious JavaScript execution can effectively prevent such attacks.
