Massive Malvertising Ambush: One Million Devices Compromised Globally

Summary

• Microsoft says a malvertising campaign reached nearly one million devices worldwide.
• Microsoft Threat Intelligence detected the campaign in early December 2024 and published details on March 6, 2025.
• The attack chain started on illegal streaming sites and used GitHub, Discord and Dropbox to host malware.
• The payloads stole information, including browser data and credentials.

What Microsoft found

Microsoft says a large malvertising campaign hit nearly one million devices around the world. Homes and businesses alike. Microsoft Threat Intelligence detected it in early December 2024 and laid out the full attack chain in a March 6, 2025 report.

How malvertising works

Malvertising combines “malicious” and “advertising.” Criminals use online ads to steer people to harmful sites or downloads. In this case, the ads ran on illegal video streaming sites. Clicking them sent victims through a series of redirect sites before landing them on malware.

Inside the attack chain

Microsoft traced the redirects to malicious files hosted mostly on GitHub, with some payloads on Discord and Dropbox. Familiar platforms helped the attackers blend in. GitHub took the repositories down.

Several stages of malware

The campaign worked in stages. The first payload gathered details about the infected system and sent them back. Later stages installed information stealers, including Lumma Stealer and an updated version of Doenerium, and on some machines the NetSupport remote access tool, while PowerShell, AutoIt scripts and registry changes kept the malware running after a reboot.

Who was affected

The campaign was indiscriminate. It hit individual users as well as organizations across many industries, and stolen browser data and credentials can give attackers a way into corporate accounts long after the original infection has been cleaned up. An earlier version of this article included quotes attributed to a “Microsoft representative” that could not be found in Microsoft’s report; they have been removed.

How to protect yourself

Microsoft recommends hardening endpoints and browsers. Keep software updated, use reputable endpoint protection with cloud-delivered protection turned on, and turn on multi-factor authentication. For companies, blocking access to illegal streaming sites and restricting script engines like PowerShell for ordinary users cuts off much of this kind of attack.

Lessons from the campaign

One click on a pirated streaming site was enough to start the chain, and the attackers hid behind trusted platforms the whole way.

That combination is common now. Defenders need to watch for unusual downloads from code-hosting and file-sharing sites. Treat ads on shady sites as a hazard.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.