Malvertising Campaign Assembles Malware in Browser Memory to Target Crypto Investors

A sophisticated malvertising campaign uses fake financial websites and JavaScript to build malware directly in browser memory, bypassing traditional network detection methods.

Key Points:

• The campaign targets retail traders and crypto investors in 12 countries using fake Solana, Luno, and TradingView pages.
• Malware is assembled locally in the browser using service workers and shared workers, avoiding the transmission of finished files over the network.
• Threat actors randomize parameters to generate unique malware hashes, evading static detection mechanisms.
• The payload likely includes keylogging, screenshot capture, network traffic interception, and cryptocurrency wallet theft.
• Users are advised to avoid downloading financial apps from social media ads and to verify digital signatures of installers.

A malvertising operation active since late 2024 is deceiving users in the Asia Pacific and Latin America regions by displaying fake versions of popular cryptocurrency and trading platforms. The attack leverages malicious JavaScript to turn the web browser into a local assembly pipeline. Instead of downloading a pre-built malicious file, the browser receives components and instructions to construct the malware executable in memory. This technique ensures that no complete malicious file is transmitted over the network, making it significantly harder for security tools to detect the threat during transit.

The process involves registering a service worker to manage the download and a shared worker to assemble the payload. By rotating session-specific parameters, attackers create unique malware hashes for each victim, bypassing static signature detection. The resulting executable is built from a clean version of the Bun executable and other remote components. Evidence suggests the final payload is designed to intercept network traffic, log keystrokes, take screenshots, and steal cryptocurrency wallet data, establishing long-term persistence on the infected device.

Security researchers emphasize that this method challenges traditional endpoint detection because the threat materializes only after the user interacts with the page. The campaign specifically filters out security scanners and bots, ensuring only real retail traders encounter the malicious pages. To mitigate risk, users should avoid downloading financial or cryptocurrency applications from social media advertisements or sponsored search results. It is critical to obtain software only from official company websites and to verify the digital signature and publisher before executing any installer.

Learn More: Bleeping Computer

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)