Malicious sites use JavaScript to build malware in browser memory
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory. The operation has been active since late 2024 and is localized to 25 languages in 12 countries, p…
Intelligence analysis by Llama
The campaign's design stands out through its use of the web browser as a local assembly pipeline for the malware. Although the fake portals feature a download button, a ReactJS library on the landing page prepares the browser for a managed download flow, a process typically used for handling various types of file transfers.
Imagine you're browsing the internet and you come across a fake website that looks like a real one. This website has a special code that helps it build a bad program right in your browser. This program can do bad things like steal your passwords or take pictures of what you're typing. It's like a sneaky way for the bad guys to get what they want without you even knowing it.
Analysis
A Malicious Malvertising Campaign
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory. The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.
How It Works
The campaign's design stands out through its use of the web browser as a local assembly pipeline for the malware. Although the fake portals feature a download button, a ReactJS library on the landing page prepares the browser for a managed download flow, a process typically used for handling various types of file transfers.
The Advantage of This Technique
The advantage of this technique is that no finished file is transmitted over the network, making detection less likely, and analysis becomes more challenging. Confiant researchers do not reveal the nature of the payload, but they found evidence supporting a Bitdefender report in 2025 about a resilient malvertising campaign that used StreamSaver to distribute malware.
The Payload's Capabilities
The payload had the following capabilities: intercept all user network traffic (acting as a proxy), collect cookie and password data, record keystrokes (keylogging), and take screenshots, steal cryptocurrency wallet data, and establish long-term persistence.
Key points
- A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.
- The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.
- The campaign's design stands out through its use of the web browser as a local assembly pipeline for the malware.
- The advantage of this technique is that no finished file is transmitted over the network, making detection less likely, and analysis becomes more challenging.
If this development plays out positively, it could lead to more effective detection and analysis of similar malvertising campaigns, ultimately reducing the risk of malware distribution through fake websites.
The realistic downside risks or failure modes of this campaign include the potential for the malware to evade detection, the possibility of the campaign spreading to more countries and languages, and the risk of the malware being used for more sophisticated attacks.
