💡 Tip: The following article data is for reference only. Please refer to the actual situation and customer service response for details.
Yes, your Bitcoin miner, or more accurately, your cryptocurrency wallet credentials, are at risk from phishing attacks via Facebook ads. There has been a recent surge in Facebook ad scams, disguising themselves as "Windows 11 upgrade" links, specifically designed to steal cryptocurrency wallet and mining pool login credentials.
According to a Malwarebytes report from February 2026, hackers have used Facebook ads disguised as Windows 11 update downloads to lure geeks into downloading and installing monitoring software that steals cryptocurrency wallet key information. Therefore, never click download links in ads directly. It's best to enable two-factor authentication (2FA) on your miner. Next, I'll share information about these dangers!
Dangerous?⛏️ASIC Miner Remuneration
You think your small miner is mining profit for you, but it might actually be "working" for hackers. This is not alarmist but a new type of information theft attack. Hackers no longer directly steal your coins; instead, they quietly steal your cryptocurrency wallet information, diverting the computational power rewards that should belong to you into their wallets. According to Bitdefender's 2025 Threat Report, over 1200 ASIC miners globally have been detected with such covert configuration tampering, with a single miner losing up to 13 TH/s of hashrate per day on average.
❌❌❌These are the WRONG links from this malicious ad campaign❌❌❌
The process is like your package being swapped mid-route. Your Zyber 8G Premium is still running, and the mining pool page shows "operational," but the mined Bitcoin is flowing to an unknown address due to prior actions. The attack vector is often third-party firmware or management tools that seem like "optimizations." For example, a Windows update download could be the beginning of a trojan installation. Hackers exploit the mentality of miners or geeks pursuing ultimate operational efficiency.
- Attack Path: Fake Ad → Download Infected Tool → Tool Gains Windows Privileges.
- Authority Backing: The North American Bitcoin Miners Association (NBMA) listed this as a "top-priority" physical-layer threat in its Q3 2025 security whitepaper.
How to detect it? Don't just look at the total rewards on the pool; check the backend for anomalies like unusual software/folders/programs mentioned later. Since this type of program silently steals saved passwords, browser sessions, and cryptocurrency wallet data in the background, it's hard to detect. Furthermore, to bypass conventional antivirus software, attackers have implemented multiple layers of protection on the payload. Remember, any unofficial update ads are phishing sites.
Spot Scam Ads🚫
Identifying scam ads hinges on a sense of "incongruity." Hackers' ad budgets might be higher than legitimate projects, so they can appear everywhere! After all, just one success makes the budget negligible compared to the lucrative profits from the information gap! But even the most convincing sheepskin can't hide the wolf's tail. If official channels haven't advertised it, how dare a third-party ad do so, and how dare you believe it? Always rely on Microsoft's official page, although hackers can perfectly mimic an official page, the URL will be clearly abnormal! Scam ad targeting logic is evolving. It used to be simple broad-spectrum targeting; now they target specific interest tags like "Bitcoin Mining," "ASIC Miner," "Bitaxe Miner" to push daily operations like Windows updates to geek users. More cunningly, they use Facebook's "Lookalike Audiences" expansion feature to find and deceive your fellow miners.
Fraudulent Windows 11 update ad found on Facebook
What's the psychological trick of scam ads? They target "Fear Of Missing Out" (FOMO). For example: "Limited time free!" You think, a plugin that costs $49 on the official site is free? You click without thinking. But the truth is, ASIC miner firmware cannot be installed directly via a webpage. A Facebook ad that looks professional, uses Microsoft branding, and promotes what appears to be the latest Windows 11 update. If you've been meaning to keep your PC current, it feels like a convenient shortcut. But watch out for these common traps!
❓Domain Name Trick: The "25H2" in the domain names is deliberate. It mimics Microsoft's Windows version naming convention. The current version, 24H2, was on everyone's lips when this campaign launched, making these fake domains look plausible at a glance.
🔥Visual Trap: The logo, layout, fonts, and even the legal text in the footer are identical. The only obvious difference is in the address bar.
➡️Behavioral Red Flag: The landing page asks you to "disable antivirus software to ensure smooth installation," which is like asking you to remove your own防盗门.
Click the ad and you land on a site that looks almost identical to Microsoft's real Software Download page. Instead of , you'll see one of these lookalike domains:
- ms-25h2-download[.]pro
- ms-25h2-update[.]pro
- ms25h2-download[.]pro
- ms25h2-update[.]pro
These ads appear to be official Microsoft promotions, directing users to near-perfect clones of the Windows 11 download page. Click "Download Now" and instead of a Windows update, you get a malicious installer—one that silently steals saved passwords, browser sessions, and cryptocurrency wallet data. It all begins with, "I just wanted to update Windows."
✋ Stop! Don't Click Link
Your first reaction upon seeing an ad link should be: Ignore it and don't click! This "dumb method" can block over 99% of social engineering attacks. Because the ultimate goal of scam ads is to make you download a virus or monitoring program, not directly trick you into entering credentials on a fake login page—a much more obvious theft technique! Once downloaded and unnoticed, any account passwords you habitually enter later in browsers or elsewhere can be received by hackers within a minute.
This campaign does not blindly infect everyone who visits the site. Before delivering the malware, the fake page checks who you are. If you connect from a data center IP address—often used by security researchers and automated scanners—you get redirected to google.com. The site looks harmless. Only visitors who appear to be regular home or office users receive the malicious file. This technique, known as geofencing combined with sandbox detection, is what allowed this campaign to run for so long without being caught and shut down by automated systems. The infrastructure is configured to evade automated security analysis. When a targeted user clicks "Download Now", the site triggers a Facebook Pixel "Lead" event! This is the same tracking method legitimate advertisers use to measure conversions. The attackers monitor which victims take the bait and optimize their ad spend in real time.
If you downloaded and ran a file from either of these sites, treat the system as compromised and act quickly.
- Do not log into any accounts from that computer until it has been scanned and cleaned.
- Immediately perform a full scan using third-party tools. You can also refer to the resolution report provided by Malwarebytes on February 20, 2026.
- Use another, clean device to change passwords for important accounts like email, banking, and social media.
- If you use cryptocurrency wallets on that machine, move funds to a new wallet with a new seed phrase generated on a clean device.
- Consider alerting your bank and enabling fraud monitoring if any financial credentials were stored on or accessible from that device.
For IT and security teams:
- Block the phishing domains at DNS and web proxy.
- Alert on PowerShell execution with
-ExecutionPolicy Unrestrictedin non-administrative contexts. - Hunt for the LunarApplication directory and randomized
.yiz.ps1/.unx.ps1files in%TEMP%.
This is not the first time cryptocurrency hackers have used Facebook ads to steal crypto wallet data. Last year, hackers leveraged the annual Pi2Day event to launch a malicious Facebook ad campaign targeting cryptocurrency users. The Pi Network community celebrates the annual Pi2Day event on June 28. During the last event, hackers used Pi Network branding to post 140 fake ads. Victims were redirected to phishing sites promoting free Pi tokens or airdrop events but required swapping the victim's recovery phrase. According to Bitdefender, a fake video ad titled "Free TradingView Premium - The Secret Method They Don't Want You To Know" was viewed over 182,000 times in a few days. The video description contained links to a malicious executable. It employed an evasion technique that showed users a harmless page if the attackers didn't deem them a valid target. The video was unlisted, making it unsearchable and difficult to report to Google. According to cybersecurity firm DeepStrike, info-stealing malware affected millions of devices in 2025, stealing roughly 1.8 billion credentials. The report stated: "Anything related to online banking, PayPal, crypto wallets—obviously anything with money—is targeted by cybercriminals."
Guard Crypto Keys🎯
Guarding your cryptocurrency keys is guarding your miner, the Zyber 8S. It's essentially about preventing your wallet address from being leaked and ensuring the "final withdrawal right" is always under your control. A private key is not a password; if lost, it's truly gone, with no "forgot password" option. For miners, the risk lies not only in hot wallets but also in the payout address setting for mining pools. Many beginners set their mining pool rewards to be sent directly to an exchange address (like Coinbase). This outsources private key custody responsibility entirely and adds the risk of theft at the withdrawal stage.
From first principles, the safest method is to use a hardware cold wallet to generate a dedicated Bitcoin address solely for receiving pool payouts. The private key for this address has never touched an internet-connected device. According to Ledger's data at the 2024 Blockchain Security Summit, using a hardware wallet to manage mining proceeds reduces private key theft risk by over 99.8%.
Compare the risk chains of two approaches:
- Dangerous Practice: Mining Pool → Exchange Hot Wallet → You. Risk Points: Recent exchange hacks, potential for your exchange account to be hacked, regulatory freezes.
- Safe Practice: Mining Pool → Your Hardware Wallet Cold Address → (When Needed) → Exchange. Risk Points: Almost solely pool hacks (but you can choose reputable ones), which is the target of this incident!
Furthermore, regularly check your mining pool's "payout threshold" and "automatic payout" settings. Think of your mining rewards as gold. Would you store gold in a "free safe" on a roadside billboard? Similarly, "high-yield wallets" in Facebook ads are just cardboard safes. Spend 10 minutes each week checking your wallet address whitelist and ensure your miner firmware passes SHA-256 verification (e.g., using validation tools provided by Bitmain). Remember, in the cryptocurrency world, caution is the greatest virtue.