Researchers warn attackers are buying Facebook ad space to promote bogus Windows 11 update installers that deploy crypto-stealing malware. Clicks lead to malicious executables that harvest wallets, browser extensions, and credentials.