MALVERTISING CAMPAIGN BUILDS MALWARE IN BROWSER MEMORY

The campaign uses counterfeit webpages mimicking Solana, Luno, and TradingView to distribute the attack. By constructing malware in memory rather than writing files to disk, the threat actors evade antivirus and security tools that typically scan stored files. This in-memory assembly technique represents an escalation in malvertising tactics. The malicious JavaScript executes when users visit the fake sites, allowing attackers to build and deploy malware without leaving traditional forensic traces. The fake pages appear designed to harvest credentials or deploy financial theft malware targeting cryptocurrency users and traders. Security researchers have documented the campaign targeting users across multiple regions. Users should verify URLs carefully before accessing financial platforms and consider using security browser extensions. Organizations can mitigate risk by implementing content security policies and restricting JavaScript execution on untrusted domains.