A large-scale malvertising operation is luring cryptocurrency and finance users to counterfeit websites that assemble malicious payloads directly inside the browser’s memory, according to reporting from BleepingComputer. The technique relies on ordinary web technologies rather than traditional downloadable executables, making the activity harder for conventional endpoint tools to spot.
Attackers have been cloning legitimate platforms familiar to traders and crypto holders—including pages impersonating Solana-related services, the Luno exchange, and the TradingView charting site. Victims reach these lookalike destinations through malicious advertisements. Once the page loads, embedded JavaScript instructs the browser to construct the malware in RAM, with WebAssembly reportedly used to help compile components on the fly. Because the payload never needs to land on disk as a conventional file, signature-based scanners and many disk-focused defenses can miss it entirely.
The approach marks a clear evolution in browser-borne threats. Instead of tricking users into running an installer, operators weaponize the same JavaScript engines and memory spaces that everyday web applications already use. Security teams that still lean heavily on file-hash blocklists or simple download monitoring therefore face an evasion gap. Behavioral detection, stricter Content Security Policy configurations, and closer scrutiny of unexpected WebAssembly or dynamic code generation become more important under this model.
Target selection underscores the campaign’s commercial focus. Crypto wallets, trading dashboards, and related financial services remain high-value prizes: a successful compromise can yield seed phrases, session tokens, or direct access to funds. By mirroring well-known brands, the operators exploit the trust users place in familiar interfaces—especially when the lure arrives via paid ads that appear above organic search results. Verifying URLs, preferring bookmarks or official apps over ad-driven links, and treating unsolicited “platform updates” with skepticism remain practical first-line defenses for individuals.
For the broader IT and open-source security community, the campaign illustrates how quickly commodity web stacks can be turned into delivery vehicles. JavaScript and WebAssembly are foundational to modern browsers; their legitimate power is exactly what makes in-memory assembly attractive to adversaries. Defenders cannot simply block these technologies. The more realistic path involves layered controls: isolating high-risk browsing, monitoring anomalous memory or process behavior inside the browser sandbox, and keeping extension and browser-update hygiene tight so that additional attack surface is minimized.
Organizations evaluating browser isolation, remote rendering, or enhanced endpoint detection should weigh how well those products surface in-memory script activity rather than only file-creation events. At the same time, advertising networks and brand owners continue to face pressure to detect cloned landing pages faster, since malvertising remains an efficient distribution channel.
BleepingComputer’s coverage highlights that the core novelty lies in the construction method—malware built inside the browser rather than fetched as a finished binary. That distinction is likely to influence both attacker tooling and defensive roadmaps for some time. Users in cryptocurrency and online trading circles, including professionals who routinely handle digital assets, have particular reason to double-check site authenticity before connecting wallets or entering credentials. Technical controls help, but they work best alongside deliberate verification habits whenever a familiar finance or trading brand appears in an unexpected ad or link.
根據BleepingComputer報導，一場大規模惡意廣告攻擊行動正誘騙加密貨幣及金融用戶訪問偽造網站，這些網站會直接在瀏覽器記憶體內組裝惡意載荷。該技術依賴常規網絡技術而非傳統可下載執行檔案，令傳統端點防禦工具更難偵測。
攻擊者複製加密貨幣交易者及持幣者熟悉的合法平台，包括仿冒Solana相關服務、Luno交易所及TradingView圖表平台的網頁。受害者透過惡意廣告進入這些仿冒網站。頁面載入後，嵌入的JavaScript會指示瀏覽器在記憶體中構建惡意軟件，據報更使用WebAssembly即時編譯組件。由於惡意載荷無需以傳統檔案形式儲存至硬碟，基於特徵碼的掃描器及許多依賴檔案系統的防禦措施可能完全失效。
此攻擊手法代表瀏覽器威脅的明顯演進。攻擊者不再誘騙用戶執行安裝程式，而是利用日常網絡應用程式同樣使用的JavaScript引擎及記憶體空間進行攻擊。仍然過度依賴檔案雜湊值封鎖清單或簡單下載監控的安全團隊，將面臨偵測缺口。在此模式下，行為偵測、更嚴格的內容安全政策配置，以及對異常WebAssembly或動態代碼生成的密切監察變得更加重要。
目標選擇突顯此行動的商業導向。加密貨幣錢包、交易介面及相關金融服務仍是高價值目標：成功入侵可竊取種子短語、登入權杖或直接訪問資金。透過仿冒知名品牌，操作者利用用戶對熟悉界面的信任——尤其當誘餌透過出現在自然搜尋結果上方的付費廣告出現時。核實網址、優先使用書籤或官方應用程式而非廣告連結，以及對自發的「平台更新」保持質疑態度，仍是個人實用的第一線防禦措施。
對廣泛的資訊科技及開源安全社群而言，此行動展示常見網絡技術堆疊如何快速被轉化為攻擊載體。JavaScript和WebAssembly是現代瀏覽器的基礎技術；其正當功能正是吸引對手採用記憶體內組裝手法的原因。防禦者不能簡單封鎖這些技術。更現實的路徑涉及分層控制：隔離高風險瀏覽、監測瀏覽器沙箱內的異常記憶體或行程行為，以及維護擴充功能和瀏覽器更新的整潔性以最小化攻擊面。
評估瀏覽器隔離、遠端渲染或增強端點偵測方案的機構，應衡量這些產品能否有效呈現記憶體內腳本活動，而非僅監測檔案建立事件。與此同時，廣告網絡及品牌持有者仍面臨壓力，需更快偵測仿冒登陸頁，因為惡意廣告仍是高效的分發渠道。
BleepingComputer報導強調，核心創新在於組裝方法——惡意軟件在瀏覽器內部構建，而非作為完整二進制檔案獲取。這一區分將在未來一段時間持續影響攻擊者工具開發及防禦路線圖。加密貨幣及線上交易領域的用戶，包括經常處理數碼資產的專業人士，特別有理由在連接錢包或輸入憑證前，再次核實網站真實性。技術控制雖有幫助，但當熟悉的金融或交易品牌出現在意外廣告或連結中時，結合刻意的核實習慣方能發揮最佳效果。