JS Malvertising Assembles Malware in Browser Memory
Fake Solana, Luno, and TradingView sites run malicious JavaScript that builds malware in browser memory — no file written, standard AV misses it.
Marisol "Fuse" Delgado BleepingComputer is reporting a large-scale malvertising campaign that does something most endpoint tools aren’t watching for: the malicious JavaScript on these fake crypto trading pages instructs the browser to assemble malware directly in memory. No file is written to disk. Nothing to scan.
The pages are impersonating Solana, Luno, and TradingView — platforms with real user bases that log in regularly to check balances and execute trades. Someone arrives via a search ad or social link, the JavaScript runs, and the browser becomes the build environment.
Why this is harder to catch
File-based antivirus is looking for an executable hitting the filesystem. Fileless delivery in the browser skips that step entirely — the payload is assembled on the heap inside the browser process and runs there. Most consumer security products don’t have visibility into that layer. A lot of enterprise products don’t either, depending on configuration.
In-memory execution has been in the post-exploitation toolkit for years. What’s changed here is the distribution layer: malvertising networks are applying it to commodity campaigns at scale, targeting retail crypto users through ad redirects and search ads rather than spearphishing a specific target.
What to actually do
For individuals:
- Get a content blocker. uBlock Origin (Firefox, Chrome, Edge) stops most malvertising before the page loads — this kills the attack chain at step one. The campaign is ad-delivered, so blocking the ad blocks the infection.
- Bookmark your actual trading platforms. Don’t arrive at TradingView or your exchange through a search ad. Type the URL or use a saved bookmark. If the domain in the address bar isn’t exactly what you expect, close the tab.
For teams managing endpoint security:
- Check whether your EDR covers memory scanning and behavioral detection, not just file signatures. Most enterprise-grade vendors offer this; the question is whether it’s actually configured and running.
- DNS-layer or proxy-based ad filtering removes the risk before it reaches endpoints at all. This is cleaner than per-endpoint configuration.
- For managed device fleets: browser policy that restricts JavaScript execution from uncategorized or unknown domains reduces the attack surface on every machine at once.
Priority call
There’s no software vulnerability to patch and no CVE waiting for a fix. This is an infrastructure and behavioral control problem. If ad blocking isn’t part of your browser security baseline already, this campaign is a concrete reason to change that. If your endpoint detection relies primarily on file-based scanning, that gap applies well beyond this one campaign.
Source: BleepingComputer, July 25, 2026
Found this useful? Share it.
