Malvertising Campaign Delivering In-Memory Malware via Fake Crypto/Trading Sites

Technical Analysis

The attackers use malvertising to lure victims to spoofed pages impersonating popular crypto and trading platforms (Solana, Luno, TradingView). Malicious JavaScript executed in the browser performs staged, in-memory construction of the malware payload, avoiding traditional file-based antivirus and EDR detection that rely on disk artifacts. This fileless technique likely leverages browser APIs (e.g., WebAssembly, ArrayBuffer manipulation, or reflective loading via JS) to decode and execute shellcode or secondary payloads without writing to disk, complicating forensic analysis and static signature detection. The payload's ultimate objective appears to be credential theft, wallet drainer functionality, or clipboard hijacking common to crypto-targeted malware families. Organizations running AI agents or automation tools that browse the web, scrape crypto/trading sites, or execute headless browser sessions for RAG pipelines could be exposed to this in-memory JavaScript payload, potentially leading to credential or API key theft if agents interact with compromised pages using stored session cookies or system-level browser contexts.

Affected Systems

Web browsers (Chrome, Edge, Firefox) on Windows and macOS visiting malicious ad-driven landing pages; any endpoint with JavaScript enabled and no advanced fileless-threat detection; browser automation frameworks (e.g., Puppeteer, Playwright, Selenium) used by AI agents that render JS content

Indicators of Compromise

• Fake domains impersonating Solana, Luno, and TradingView (specific domains not disclosed in source)
• Malvertising ad network redirect chains (details pending further research)
• Suspicious inline/obfuscated JavaScript performing dynamic memory buffer construction

Remediation Steps

1. 1

   Deploy browser isolation / sandboxing

   Use remote browser isolation or sandboxed browsing environments for high-risk activities like crypto trading to prevent in-memory payload execution from reaching host systems.

2. 2

   Enable advanced EDR with fileless-threat detection

   Ensure endpoint detection tools can monitor browser process memory and JavaScript engine behavior, not just disk-based file scanning.

3. 3

   Block malicious ad networks and domains

   Use DNS filtering, ad-blockers, and threat intelligence feeds to block known malvertising domains and redirect chains.

4. 4

   Restrict browser automation exposure

   For AI agents or automation frameworks using headless browsers, restrict access to untrusted URLs, disable unnecessary JavaScript execution, and isolate credential storage from browser sessions.

5. 5

   User awareness training

   Educate users to verify URLs of crypto and trading platforms directly rather than clicking on search ads or sponsored links.