Security News Malicious sites use JavaScript to build malware in browser memory

[Parkinsond]

Content source

https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.

The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.

A filtering system ensures that only real targets (retail traders and crypto investors) land on the malicious pages, while researchers, scanners, and security bots are redirected to blank pages.

According to Confiant's analysis, the page first registers a service worker, which acts as a download manager and helps build the malware file incrementally.

In the first stage, the page sets up a shared worker that acts as an engine that assembles the malware from components received in the next steps of the attack.

The researchers say that in the second stage "the landing page uses its SharedWorker to request itself for a ‘/config’ response" with seed and size parameters that are randomized and specific for each session.

By rotating these parameters, the threat actors make sure that the resulting malware file has a unique hash to bypass static detection.

Remote components retrieved this way and the locally generated bytes are then used to create the malicious payload from a clean version of the Bun executable.

After building the final malware executable, the fake download page hands it to the service worker at the beginning of the process and triggers a same-origin download path.

"From the browser’s point of view, the user is downloading an executable from the landing page domain," Confiant researchers say, and the mark-of-the-web tag is added, despite some of the components originating from a different source.

The advantage of this technique is that no finished file is transmitted over the network, making detection less likely, and analysis becomes more challenging.

Malicious sites use JavaScript to build malware in browser memory

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.

www.bleepingcomputer.com

 

[Parkinsond]

Could ASR rule "Block JavaScript or VBScript from launching downloaded executable content" help?

 

[Brahman]

Could ASR rule "Block JavaScript or VBScript from launching downloaded executable content" help?

You can use noscript addon on browser to stop such scripts and allow only those websites which are well known to you. This option prevents the downloading itself.

 

[Parkinsond]

You can use noscript addon on browser to stop such scripts and allow only those websites which are well known to you. This option prevents the downloading itself.

The only problem that most websites, except reading blogs, rely on JS for dispalying properly.
Even those not frequently visited need JS to work as expected.

 

[Andy Ful]

Could ASR rule "Block JavaScript or VBScript from launching downloaded executable content" help?

No. This is JavaScript hosted by the web browser (in-browser attack).

 

[Sampei.Nihira]

The only problem that most websites, except reading blogs, rely on JS for dispalying properly.
Even those not frequently visited need JS to work as expected.

Not all scripts and frames on every website are necessary for viewing the website itself.
Some can be safely blocked without any consequences.

 

[Parkinsond]

Not all scripts and frames on every website are necessary for viewing the website itself.
Some can be safely blocked without any consequences.

I bet the average user, like me, cannot tell.

 

[Sampei.Nihira]

I bet the average user, like me, cannot tell.

With the new extensions,which often include a whitelist and a blacklist,even the average user can choose from a few scripts to allow and/or block.
It's not complicated at all.

 

[Parkinsond]

With the new extensions,which often include a whitelist and a blacklist,even the average user can choose from a few scripts to allow and/or block.
It's not complicated at all.

Average users do not know about the invention of browser extensions; they just use Chrome as it is.

 

[Sampei.Nihira]

Average users do not know about the invention of browser extensions; they just use Chrome as it is.

Come on, no way...
All it takes is a little info found online.

 

[Parkinsond]

Come on, no way...
All it takes is a little info found online.

They do not even know how to select block when prompted for allowsing notification by browser to be bombarded by malicious notifications; Reddit are full posts regarding everyday.

 

[nicolaasjan]

How about blocking Service Workers.
In uMatrix (Chromium), I have this rule (for as long as this MV2 extension keeps working here...):
no-workers: * true
In Firefox, I've set in about:config:
dom.serviceWorkers.enabled → false

 

[oldschool]

@Parkinson this campaign is targeted to a select audience of retail traders and crypto investors. Average users are not.

The advice of the researchers is quite simple:

Since the SourTrade campaign targets retail traders and crypto investors, users engaged in these activities are advised to avoid downloading financial or cryptocurrency apps from social media advertisements or sponsored search results.

The researchers advise getting executable files from the company's official website. As an added precaution, they should verify the installer’s digital signature and publisher before running it.

BTW, the advice about downloading apps from official, recognized sites and not via sponsored sites and verifying signatures are standard practice for good web hygiene.

 

[Parkinsond]

@Parkinson this campaign is targeted to a select audience of retail traders and crypto investors. Average users are not.

The advice of the researchers is quite simple:

BTW, the advice about downloading apps from official, recognized sites and not via sponsored sites and verifying signatures are standard practice for good web hygiene.

In rare cases, older versions of installers could be donwloaded only from 3rd party websites.
The installer after download will be clean after scan, but just initiating download of the clean installer, will start a hidden cascade.

 

[oldschool]

The installer after download will be clean after scan, but just initiating download of the clean installer, will start a hidden cascade.

Indeed, but the malware campaign is only for the select targets. This isn't a widespread attack.

 

[Parkinsond]

Indeed, but the malware campaign is only for the select targets. This isn't a widespread attack.

This specific? yes.
But the same methodology is applicable to several different target groups.

 

[Victor M]

Cybercrooks will re-use and adapt new techniques. What is used against one target group WILL BE USED AGAINST ANY. There is no copyright among cybercrooks. When you say "nah, this doesn't apply to me' then you stand to lose, buddy.

 

[Marko :)]

Cybercrooks will re-use and adapt new techniques. What is used against one target group WILL BE USED AGAINST ANY. There is no copyright among cybercrooks. When you say "nah, this doesn't apply to me' then you stand to lose, buddy.

Again, the only goal of these hacking attacks is to steal the money. This is why hackers only attack crypto exchanges and businesses. No point in attacking, you or me, because we don't have millions is our bank accounts.

 

[Parkinsond]

Again, the only goal of these hacking attacks is to steal the money. This is why hackers only attack crypto exchanges and businesses. No point in attacking, you or me, because we don't have millions is our bank accounts.

True; they will not use the technique for Parkinsond or Marko; they will use through Notepad++ or 7-Zip official page.
While we are legitimately downloading their latest installer, a js-based malware will be assembled in our FF or Brave memory silently to collect our banking account data or other accounts logged in while it is active.