On July 31, according to Cointelegraph, Check Point Research revealed that a malware campaign codenamed "JSCEAL" is impersonating nearly 50 popular cryptocurrency trading applications worldwide, including Binance, MetaMask, and Kraken. The campaign has been active since March 2024, enticing users to download fake applications containing malware through malicious advertisements.

Research shows that 35,000 malicious ads have been placed in the first half of 2025, affecting millions of users in the EU alone. The malware employs unique anti-detection techniques, capable of collecting sensitive data such as user keyboard input, Telegram account information, and autofill passwords, and can manipulate cryptocurrency-related browser plugins. Experts recommend using anti-malware that can detect malicious JavaScript execution to effectively prevent such attacks.