As reported by BleepingComputer, a large-scale malvertising campaign is leveraging spoofed pages impersonating Solana, Luno, and TradingView to deliver malware assembled entirely within browser memory — a technique that represents a meaningful evolution in attacker tradecraft and one that demands immediate attention from defenders and end users alike.
Why This Attack Is Different
Traditional malware delivery relies on dropping a file to disk — an executable, a script, a document — where endpoint detection and response (EDR) tools, antivirus engines, and file integrity monitors have a fighting chance of catching it. What makes this campaign particularly concerning is the deliberate avoidance of that step entirely. By using JavaScript running inside the browser to assemble the malicious payload in memory, attackers eliminate the artifact that most enterprise security tooling is optimized to detect.
This is not a novel concept in the abstract — fileless malware and living-off-the-land (LotL) techniques have existed for years — but operationalizing it through ordinary browser JavaScript at campaign scale is a significant escalation. It means the delivery infrastructure looks, at least superficially, like any other website serving dynamic content.
The critical insight here: If your security stack only inspects what touches disk, in-memory assembly attacks will sail through undetected. Browser telemetry and memory analysis capabilities are no longer optional for mature security programs.
Who Is Most at Risk
The choice of lure domains — Solana, Luno, TradingView — is not accidental. These platforms attract cryptocurrency traders, DeFi enthusiasts, retail investors, and fintech professionals. This is a financially motivated campaign targeting individuals most likely to:
But enterprise defenders should not dismiss this as a consumer problem. Employees in finance, fintech, and crypto-adjacent industries regularly visit these platforms on corporate or BYOD devices. A single compromised endpoint inside a trading firm or financial institution can be catastrophic.
The Broader Threat Landscape Implication
This campaign illustrates a broader trend: attackers are increasingly treating the browser as the primary attack surface. As organizations harden their perimeters and endpoints, the browser — a fully capable JavaScript runtime with access to session tokens, saved credentials, clipboard data, and extension APIs — becomes the path of least resistance.
Browser-native attacks also complicate incident response. Memory forensics is considerably harder than file artifact recovery, and most organizations lack the tooling and expertise to reconstruct what a malicious script assembled ephemerally in a browser process. This means many infections from campaigns like this will go entirely unattributed.
Shield53 Recommendations
Immediate Actions
- Deploy browser isolation or enterprise browser solutions. Technologies that execute web content in a remote or sandboxed environment prevent in-memory payloads from ever reaching the user's actual device. Vendors like Menlo Security, Island, and Talon offer purpose-built options.
- Enable script blocking or strict Content Security Policies. Tools like uBlock Origin (for users) or enterprise proxy-based JavaScript filtering can significantly reduce exposure to malicious JS execution.
- Audit DNS and web proxy logs for spoofed domain access. Look for lookalike domains mimicking Solana (solana.com), Luno (luno.com), and TradingView (tradingview.com). Typosquatting and subdomain abuse are common delivery mechanisms in malvertising campaigns.
- Enforce browser extension controls. Limit which extensions can run in your environment. Malicious scripts frequently target wallet extensions and credential managers accessible via the browser.
- Invest in endpoint memory scanning capabilities. Ensure your EDR solution has behavioral detection and memory scanning enabled — not just file-based signatures. Test this capability explicitly against in-memory shellcode techniques.
For Crypto Users and Traders Specifically
- Bookmark legitimate trading and portfolio sites directly — never navigate to them via search ads or third-party links.
- Use a dedicated, hardened browser profile (or browser) exclusively for crypto activity, with no other extensions installed.
- Consider hardware wallet authentication for all high-value transactions to limit the blast radius of a compromised browser session.
For Security Teams
- Add detection logic in your SIEM/EDR for anomalous child process spawning from browser executables (e.g., chrome.exe, msedge.exe spawning PowerShell, cmd, or wscript).
- Review your threat intelligence subscriptions for indicators related to this campaign and block associated infrastructure proactively.
- Conduct tabletop exercises that specifically model fileless, browser-delivered compromise — many IR playbooks are still anchored to file-based attack assumptions.
The browser has become the new endpoint. Organizations that fail to extend their security posture into this layer will find themselves perpetually behind campaigns that are already exploiting that gap at scale.
