Cyber Mirage: Scammer Hits Hundreds with Facebook Ads and Telegram Malware

By Fred Templeton, CISA, CASP, SEC+   Published: 03/10/25   Updated: 10/27/26   3 min read
Cyber News

Cyber Mirage: Scammer Hits Hundreds with Facebook Ads and Telegram Malware

Summary

How the Scam Worked

Positive Technologies reported in March 2025 on a threat actor it calls “Desert Dexter.” The group set up Facebook pages posing as news outlets and ran ads that pointed to files on Telegram channels and file-sharing sites. Victims who opened the downloads got a modified version of AsyncRAT, a remote access trojan. Researchers counted about 900 potential victims.

Who is Desert Dexter?

The operators have not been named publicly. Positive Technologies said the group appears to be Arabic-speaking. Its targets were concentrated in Libya, Saudi Arabia, Egypt and Turkey, with others in the UAE and Qatar.

Exploiting Trust

The campaign relied on trust. Ads looked like news posts on politically charged topics, which made people click. When Facebook took down an ad account, the group simply created new ones.

How the Malware Propagates

Clicking an ad led to a RAR archive. Scripts inside it ran PowerShell to load the AsyncRAT payload, which then searched for cryptocurrency wallet extensions and logged keystrokes. A Telegram bot received reports from infected machines. (Earlier versions said the lure was fake productivity software and the target was banking credentials; that has been corrected.)

Pervasive Reach

Pairing social media ads with a messaging app gave the attackers reach and a low-cost way to rotate infrastructure.

How Users Can Protect Themselves

Security teams are pushing users to treat ads that link to downloads with suspicion. Real news outlets do not ask readers to download archives to see a story. Even so, cases like this show how quickly cheap tactics can work at scale.

The Broader Cybersecurity Narrative

As platforms change, attackers adapt their methods. Technology helps, but user awareness still does much of the work. (A quote attributed to a named analyst in an earlier version has been removed because we could not confirm it.)

Lessons From Desert Dexter

Desert Dexter did not need advanced tools. It needed believable ads and a free messaging app. Users who stop before downloading files from social media posts close off most of this risk, and platforms that catch rotating ad accounts faster can do the rest.

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.