Malvertising Campaign Turns Browsers Into Malware Assembly Lines
A massive malvertising campaign leverages fake Solana, Luno, and TradingView websites to deliver malware through a clever technique that turns the victim's browser into an assembly pipeline. Active since late 2024, the operation targets retail traders and crypto investors across 25 languages in 12 countries, primarily in the Asia Pacific and Latin American regions. A filtering system redirects security researchers and automated scanners to blank pages, ensuring that only intended targets reach the malicious content.
The attack stands out because it uses JavaScript and web workers to construct the malware executable directly in the browser's memory rather than transmitting a complete file. The landing page registers a service worker that manages the download flow, while a shared worker assembles the malicious payload from components fetched in multiple stages. By randomizing seed and size parameters for each session, the threat actors ensure every resulting malware file has a unique hash, effectively evading static detection methods.
The final payload is built from a clean version of the Bun executable combined with locally generated bytes and remotely retrieved components. Once assembly is complete, the fake download page triggers a same-origin download path that appears legitimate to the browser. This approach means no finished malware file ever traverses the network in its complete form, making it significantly harder for traditional security tools to intercept or identify the threat before it reaches the victim's machine.