A large malvertising operation is using fake cryptocurrency and trading websites to deliver browser memory malware. Instead of sending a completed malicious file to victims, the campaign uses JavaScript to assemble the payload directly inside the browser.
The operation has been active since late 2024. It targets retail traders and cryptocurrency investors through convincing copies of popular financial platforms, including Solana, Luno and TradingView.
Researchers found the campaign active in 25 languages across 12 countries, with most activity focused on Asia-Pacific and Latin America.
Fake trading sites filter out researchers
The malicious websites do not expose the attack to every visitor. A filtering system checks whether someone appears to be a genuine target before showing the fake download page.
Security researchers, automated scanners and security bots are instead redirected to blank pages. This makes the campaign harder to detect and analyse.
Visitors who pass the checks see a page that looks like a legitimate trading or cryptocurrency platform. It includes a download button that appears to offer an app or installer.
JavaScript builds malware inside the browser
The browser memory malware campaign relies on JavaScript components that prepare a managed download process. The page first registers a service worker, which acts as a local download manager.
Next, the website creates a shared worker that assembles the malware from separate components. The landing page then requests a special configuration response using unique seed and size values for every session.
Those values change for each visitor. As a result, the final malware file receives a different hash every time it is built. This can make static detection more difficult because security tools cannot simply identify one known malicious file.
The response does not contain a normal downloadable installer. Instead, it provides a template and the data needed for the browser to construct the executable locally.
Same-origin downloads help hide the attack
The remote components and locally generated data are combined with a clean version of the Bun executable. Once the browser builds the final file, the service worker triggers a download from the same domain as the fake website.
From the victim’s perspective, the executable appears to come directly from the trading or crypto site they visited. The downloaded file can also receive the usual mark-of-the-web tag, even though parts of it were retrieved from another source.
No completed malware file is sent across the network. That design gives the attackers an important advantage because it reduces obvious signs of a malicious download and complicates security analysis.
Campaign changed its delivery method
Earlier versions of the operation used StreamSaver, a tool that can help websites manage file downloads. Since April, the campaign has shifted to a same-origin service worker delivery method.
Researchers have not identified the exact current payload. However, earlier reporting linked similar activity to malware capable of intercepting network traffic, stealing cookies and passwords, recording keystrokes, taking screenshots and targeting cryptocurrency wallets.
The malware may also establish persistence, allowing attackers to maintain access to compromised devices.
How traders can avoid browser memory malware
Crypto investors and retail traders should avoid downloading apps from social media adverts, sponsored search results or unfamiliar links. Attackers often use paid adverts to place fake financial websites in front of potential victims.
Always download trading and cryptocurrency software from the company’s official website. Before running an installer, check its digital signature and confirm that the listed publisher is legitimate.
The browser memory malware campaign shows how attackers are adapting web technologies to evade detection. A familiar-looking website and a normal download prompt are no longer enough to prove that a file is safe.
0 responses to “Browser Memory Malware Campaign Targets Crypto Traders”