JavaScript-Powered Malvertising Builds Malware Silently in Browser Memory
A sophisticated malvertising operation tricks crypto traders with fake sites that use JavaScript to construct malware entirely in the browser, avoiding network-based defenses. The campaign targets users in Asia-Pacific a…
An active malvertising campaign is leveraging malicious JavaScript to assemble malware directly within a victim's browser memory, sidestepping traditional security measures. First identified in late 2024, the operation uses fake websites impersonating popular cryptocurrency and trading platforms like Solana, Luno, and TradingView. The campaign, localized into 25 languages and targeting 12 countries across Asia-Pacific and Latin America, employs a filtering mechanism to redirect security scanners and bots to blank pages, ensuring that only genuine retail traders and crypto investors are exposed.
The attack's core innovation lies in transforming the browser into a local malware assembly line. When a user lands on a fake portal, a ReactJS library registers a service worker that acts as a download manager. Simultaneously, a shared worker is set up as an engine that incrementally builds the malware from components fetched through a special '/config' endpoint. This endpoint returns an assembly template—not a finished file—along with randomized seed and size parameters that generate a unique hash for each session, frustrating static signature-based detection. The final payload is crafted by combining remote parts with locally produced bytes, using a clean version of the Bun executable as a base.
After the payload is constructed in memory, the service worker triggers a same-origin download, so the browser treats it as a legitimate file from the viewed domain. This technique means no completed malware binary ever traverses the network, greatly reducing the chances of interception by network security tools. Earlier variants of this campaign, dubbed SourTrade by ad security firm Confiant, relied on the StreamSaver project to handle downloads, but since April 2025 they have switched to the service worker method for better stealth.
According to a 2025 Bitdefender report, the delivered malware possesses extensive spying and theft capabilities: it can act as a proxy to intercept all user traffic, harvest cookies and passwords, log keystrokes, capture screenshots, steal cryptocurrency wallet data, and establish persistent access. Users in the targeted demographics are urged to only download financial or crypto applications from official company websites and to verify digital signatures before running any installer.
For website owners and businesses, employing a secure DNS service like AEU DNS can add an important layer of defense by blocking access to known malicious domains associated with such malvertising campaigns, helping to prevent end-users from ever reaching the dangerous landing pages.