Malvertising campaign assembles malware in browser

A large-scale malvertising campaign is using fake websites for Solana, Luno, and TradingView, employing malicious JavaScript to assemble malware directly in the user's browser. This operation, active since late 2024, targets retail traders and crypto investors across 12 countries, primarily in the Asia Pacific and Latin America regions, as first reported by Bleeping Computer.

The campaign employs a sophisticated technique where the web browser acts as a local assembly pipeline for malware. Fake download pages register a service worker to manage the download process, incrementally building the malware file. A shared worker then acts as an engine, requesting configuration data with randomized parameters to ensure each malware file has a unique hash, bypassing static detection. The assembled malware is built from retrieved remote components and locally generated bytes using a clean version of the Bun executable. This method avoids transmitting a finished file over the network, making detection and analysis more challenging. Earlier variants used StreamSaver, but the campaign has since switched to the ServiceWorker delivery method. While the payload's exact nature is not disclosed, it is believed to be similar to malware previously reported to intercept network traffic, steal credentials and cryptocurrency, log keystrokes, and establish persistence. Users are advised to download financial applications only from official websites and verify installer signatures.

Source: Bleeping Computer