A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.
The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.
A filtering system ensures that only real targets (retail traders and crypto investors) land on the malicious pages, while researchers, scanners, and security bots are redirected to blank pages.
According to Confiant's analysis, the page first registers a service worker, which acts as a download manager and helps build the malware file incrementally.
In the first stage, the page sets up a shared worker that acts as an engine that assembles the malware from components received in the next steps of the attack.
The researchers say that in the second stage "the landing page uses its SharedWorker to request itself for a ‘/config’ response" with seed and size parameters that are randomized and specific for each session.
By rotating these parameters, the threat actors make sure that the resulting malware file has a unique hash to bypass static detection.
Remote components retrieved this way and the locally generated bytes are then used to create the malicious payload from a clean version of the Bun executable.
After building the final malware executable, the fake download page hands it to the service worker at the beginning of the process and triggers a same-origin download path.
"From the browser’s point of view, the user is downloading an executable from the landing page domain," Confiant researchers say, and the mark-of-the-web tag is added, despite some of the components originating from a different source.
The advantage of this technique is that no finished file is transmitted over the network, making detection less likely, and analysis becomes more challenging.
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.
www.bleepingcomputer.com
