Bitdefender Labs has identified a widespread malvertising network operating across 13 countries in the Asia-Pacific (APAC) region, distributing over 12,000 scam campaigns through paid advertisements on Meta platforms. Between January and April 2026, researchers Alexandra Svetlana Dinulica and Vlad Mihai Sireanu observed more than 400,000 ad sightings associated with these campaigns.
The fraudulent advertisements, while varied in content, consistently employ similar underlying tactics. Health and finance-related scams collectively account for 37.3% of all observed campaigns, with health scams making up 19% and finance scams 18%. Other categories include entertainment, home, gambling, courses, beauty, and software. Australia alone was the target of 52% of the identified scam campaigns.
Researchers noted three primary cross-country patterns: fake application downloads, scandal-driven phishing, and AI-themed investment scams. Scammers frequently reuse infrastructure, fake landing pages, redirect chains, and campaign templates across different countries and scam categories.
The typical attack flow begins with a seemingly legitimate paid ad, often featuring trusted brands, well-known personalities, or credible-looking news sources. In some instances, the ad preview even displays a legitimate domain. Upon clicking, users are redirected through one or more intermediary pages before arriving at a fraudulent website, a phishing form designed to steal credentials, or a malicious download. These final destinations are frequently rotated to evade detection.
Health-themed scams exploit consumer fears and vulnerabilities through emotionally persuasive narratives, fabricated expert authority, and pseudo-scientific claims. These campaigns promote unverified remedies, insurance "loopholes," and wellness products using false testimonials, conspiracy theories, manipulated medical data, and misleading urgency. Common tactics include impersonating medical professionals, claiming "suppressed" solutions, using newly created suspicious domains, and employing lead-generation funnels. Examples include scams related to sleep disorders, anti-snoring devices, "whistleblower doctor" respiratory remedies, health insurance "hacks," and weight loss supplements.
Financial scams often involve impersonating legitimate platforms such as Binance, TradingView, or Wise. These ads may offer bonuses, premium upgrades, or desktop application downloads, leading to fake sites designed to steal credentials or install malware. This pattern has been observed in Vietnam, Japan, Bangladesh, Thailand, Malaysia, New Zealand, and the Philippines, often utilizing near-identical infrastructure.
Another financial scam tactic involves creating fake "breaking news" stories featuring central banks, economists, or celebrities to induce urgent clicks. Campaigns linked to the Reserve Bank of Australia, Bank Negara Malaysia, and celebrity figures in Japan and Bangladesh have been identified. AI-themed investment scams, the third pattern, promise "AI-powered insights," "stock diagnostics," or automated strategies rather than direct profits.
While Australia sees more polished and convincing scams, often posing as breaking news or using familiar names, India experiences a higher volume of similar messages pushed through numerous fake accounts. Southeast Asian markets combine both approaches, with fake apps, investment offers, and impersonated brands appearing across multiple countries with minor adjustments. Localized strategies are also employed, such as using local languages and public figures in Bangladesh, real financial data in Singapore to legitimize fake tools, and low-cost offers in Indonesia to initiate conversations that quickly move to private messages.
Despite these regional variations, the underlying system remains interconnected, with the same fake apps, investment scam types, and even accounts appearing in multiple countries. Many campaigns are designed for cross-border operation or spill into new markets as they gain traction, indicating a cohesive and adaptive malvertising ecosystem.
