Fake Windows 11 Facebook Upgrade Ads on 25 February 2026 Linked to Crypto-Stealing LunarApplication Malware

On 25 February 2026, researchers reported an active malware campaign using fake Windows 11 upgrade ads on Facebook to compromise cryptocurrency users. The scheme redirects victims to Microsoft-style clone sites that deliver a malicious installer hiding the "LunarApplication" infostealer. Once executed, the malware targets wallet seed phrases, exchange credentials, and saved passwords while using geofencing and sandbox checks to evade security tools.