Malicious sites use JavaScript to build malware in browser memory

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.

The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.

A filtering system ensures that only real targets (retail traders and crypto investors) land on the malicious pages, while researchers, scanners, and security bots are redirected to blank pages.

Ad security platform Confiant says that the campaign's design stands out through its use of the web browser as "a local assembly pipeline" for the malware.

Although the fake portals feature a download button, a ReactJS library on the landing page prepares the browser for a managed download flow, a process typically used for handling various types of file transfers.

Fake TradingView site
Source: Confiant

According to Confiant's analysis, the page first registers a service worker, which acts as a download manager and helps build the malware file incrementally.

In the first stage, the page sets up a shared worker that acts as an engine that assembles the malware from components received in the next steps of the attack.

The researchers say that in the second stage "the landing page uses its SharedWorker to request itself for a ‘/config’ response" with seed and size parameters that are randomized and specific for each session.

By rotating these parameters, the threat actors make sure that the resulting malware file has a unique hash to bypass static detection.

Confiant explains that "‘/config’ is an assembly response rather than a normal download response. It returns a template and the inputs the browser needs to build the file locally."

Remote components retrieved this way and the locally generated bytes are then used to create the malicious payload from a clean version of the Bun executable.

After building the final malware executable, the fake download page hands it to the service worker at the beginning of the process and triggers a same-origin download path.

"From the browser’s point of view, the user is downloading an executable from the landing page domain," Confiant researchers say, and the mark-of-the-web tag is added, despite some of the components originating from a different source.

The advantage of this technique is that no finished file is transmitted over the network, making detection less likely, and analysis becomes more challenging.

Confiant says that earlier variants of the SourTrade campaign used the StreamSaver project on GitHub to deliver the malicious payload. Since April, though, the operation switched to the same-origin ServiceWorker delivery method.

While Confiant researchers do not reveal the nature of the payload, they found evidence supporting a Bitdefender report in 2025 about a resilient  malvertising campaign that used StreamSaver to distribute malware.

Bitdefender found that the payload had the following capabilities:

•     intercept all user network traffic (acting as a proxy)
•     collect cookie and password data
•     record keystrokes (keylogging) and take screenshots
•     steal cryptocurrency wallet data
•     establish long-term persistence

Since the SourTrade campaign targets retail traders and crypto investors, users engaged in these activities are advised to avoid downloading financial or cryptocurrency apps from social media advertisements or sponsored search results.

The researchers advise getting executable files from the company's official website. As an added precaution, they should verify the installer’s digital signature and publisher before running it.

Source