javascript

A malvertising campaign named SourTrade targets retail traders and crypto investors by making browsers assemble malware executables in real-time using a legitimate Bun runtime, rather than delivering complete malicious files directly. The campaign, active since late 2024, impersonates popular platforms and uses ServiceWorkers and SharedWorkers to dynamically build unique malware payloads per victim, evading hash-based detection. Security experts advise verifying software downloads only from official vendor sites and analyzing the entire delivery chain, including ad referrals and runtime fetches, to effectively detect and prevent this threat.

https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html

A widespread malvertising campaign uses malicious JavaScript on fake Solana, Luno, and TradingView sites to assemble malware directly in browser memory, bypassing traditional detection methods. The attack targets retail traders and crypto investors in 12 countries by building unique malware payloads locally using service and shared workers, then delivering them via a same-origin download process. Security researchers warn users to avoid downloading financial apps from ads and to obtain executables only from official sites with verified digital signatures.

https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/