Malvertising Campaign Assembles Malware In-Browser Using JavaScript

What Happened

BleepingComputer reports a large-scale malvertising campaign using fake webpages impersonating Solana, Luno, and TradingView. According to the report, these sites deliver malicious JavaScript that assembles malware directly in browser memory rather than relying on a traditional file download.

Details on the full delivery chain, payload family, and threat actor attribution have not yet been disclosed in the source reporting.

Why It Matters

By constructing malicious code in memory via JavaScript rather than dropping an executable to disk, this technique can reduce visibility for defenses that rely primarily on file-based scanning or download inspection. Because the lures impersonate cryptocurrency and trading platforms (Solana, Luno, TradingView), users researching or trading crypto assets appear to be a primary target, making this relevant to organizations with employees who interact with financial or crypto-related sites.

What Defenders Should Watch For

• Monitor for browsers spawning unexpected child processes or making anomalous outbound connections shortly after visiting unfamiliar or newly registered domains.
• Review browser and endpoint telemetry for unusual JavaScript execution patterns, such as heavy use of dynamic code generation/eval-like behavior on pages mimicking financial or crypto brands.
• Flag ad-network traffic and malvertising indicators leading to lookalike domains for Solana, Luno, TradingView, or similar platforms.
• Reinforce browser isolation, ad-blocking, and script-control policies (e.g., restricting untrusted JavaScript execution) on endpoints where crypto or trading activity is expected.
• Educate users who engage with crypto/trading sites to verify URLs carefully, since this campaign relies on convincing impersonation rather than exploiting a specific vulnerability.

Developing Story

This is net-new intelligence and technical specifics — including the exact in-memory execution mechanism, payload capabilities, and scope of the campaign — are still emerging. For the original reporting, see BleepingComputer's coverage.