A malware campaign is tearing through Facebook’s ad network, hijacking the names of legit crypto brands and Elon Musk’s face to con users into downloading spyware.

If you’re a guy over 18 and into crypto who lives in Eastern Europe, there’s a decent chance Facebook’s algorithm is trying to sell you a fake version of Binance right now.

According to a new investigation from Bitdefender Labs, cybercriminals are flooding Meta’s ad network with targeted campaigns that impersonate big-name cryptocurrency exchanges, such as Binance, TradingView, and MetaMask.

The scammers are using Meta’s own ad tools to fine-tune their targeting, filtering victims based on operating system, IP address, browser choice, and Facebook login status to spread malicious content prompting victims to install malware.

One fake crypto page reportedly ran more than 100 Facebook ads in a single day. Most were pulled fast, but not before getting thousands of views.

Bitdefender says hundreds of these spoof pages are still active, many using fake promotions featuring celebrities like Elon Musk, Zendaya, or Cristiano Ronaldo, whose real-world partnership with Binance gives the lie more credibility.

Once a victims click on the ad, they land on a fake site designed to look exactly like Binance or TradingView, and are prompted to download a client app.

However, behind the scenes, a script on the site checks if the victim is the right kind of mark, if you are logged on Facebook, use Edge browser, and are located in the desired location. Then the data-stealing malware starts rolling on the victim’s device.

Such a sophisticated user-tracking method helps to bypass conventional defenses and maintain a large pool of victims. Bitdefender says the attackers are using specific ad targeting, choosing men over 18 in Slovakia and Bulgaria who are interested in cryptocurrencies.