Malvertising Sends Malware Using Browser Assembly
Cybersecurity researchers have uncovered a new Malvertising Sends Malware campaign targeting cryptocurrency investors and retail traders. Instead of downloading a complete malware file, victims unknowingly let their browsers assemble it. As a result, the attack becomes harder to detect. Furthermore, attackers use trusted software components to hide malicious activity. Therefore, traditional file-based security tools may struggle to identify the threat.
According to a recent report, the campaign has been active since late 2024. It impersonates popular trading and cryptocurrency platforms to gain user trust. Moreover, it targets users across 12 countries and supports 25 languages. The fake websites closely resemble legitimate services. Consequently, many victims may not notice the deception before downloading malware.
Fake Ads Lead Victims to Malicious Websites
The attack begins with a malicious online advertisement. However, users must click the ad before the attack continues. The fake website then checks each visitor before showing any content. For example, suspected researchers and automated systems receive blank pages instead of the fake website. Therefore, attackers reduce the chances of security researchers detecting the campaign.
Selected visitors see convincing copies of trusted trading platforms. The website quietly prepares the attack before the user downloads anything. Meanwhile, it loads browser components that help assemble the final malware. This process happens entirely inside the browser. As a result, attackers avoid delivering a complete malicious file directly.
Browser Builds the Malware
Instead of downloading a finished executable, the browser creates one locally. First, it downloads a legitimate runtime from another server. Next, configuration files provide small malware components and assembly instructions. Furthermore, the browser combines these pieces into a Windows executable. Therefore, no complete malware file travels across the network.
Researchers explained that the browser uses several data fragments during assembly. Some fragments contain executable headers. Others contain encrypted program code. Meanwhile, the browser generates additional random data during the process. Consequently, every downloaded file receives a unique digital fingerprint.
Unique Files Reduce Detection
Each victim receives a slightly different malware file. However, the malicious functionality remains the same. Attackers simply change random values during assembly. Therefore, every executable produces a different file hash. This technique makes simple hash-based detection much less effective.
The attack also keeps standard browser security protections active. For example, the downloaded file still receives the usual internet security label. However, that label points to the fake landing page instead of every supporting server. As a result, investigators may have fewer clues during an incident response.
Researchers Track Campaign Evolution
Researchers discovered that the attackers previously used a different download method. Earlier versions relied on an open-source streaming library hosted elsewhere. However, the latest campaign now performs the entire streaming process from its own infrastructure. Therefore, the attackers reduce outside dependencies while keeping the same delivery strategy.
Researchers also compared this campaign with earlier malware operations targeting cryptocurrency users. Some technical similarities exist between the campaigns. However, the available evidence does not confirm that both attacks deliver identical malware. Therefore, researchers avoided making unsupported conclusions. Instead, they focused on the documented delivery technique.
Why This Technique Matters
The campaign does not exploit a browser vulnerability. Instead, it abuses normal browser features in unexpected ways. For example, browser workers and streaming functions help build the executable. Therefore, attackers rely on trusted browser behavior rather than software flaws.
Researchers also emphasized that defenders should inspect the complete attack chain. Monitoring only downloaded files may not reveal the full activity. Instead, security teams should review advertisements, landing pages, configuration requests, and browser downloads together. Consequently, organizations gain better visibility into sophisticated attacks.
How to Reduce the Risk of Malvertising Attacks
Organizations should train employees to avoid downloading software from online advertisements. Instead, users should always install applications from official vendor websites. Furthermore, advanced managed detection and response services can identify suspicious browser behavior before malware executes.
Continuous threat monitoring and proactive incident response also help security teams detect complex attack chains early. Together, these measures reduce the risk of malware infections and improve overall cyber resilience.
Sleep well, we got you covered.
