Malicious sites use JavaScript to build malware in browser memory
Massive malvertising campaign bypasses traditional defenses, escalating enterprise risk.
The interesting part of this story isn’t the “fileless” malware. It’s the assumption that your endpoint security tools are actually watching the browser.
What happened
A malvertising campaign is using JavaScript to build malware directly in browser memory. It targets crypto users by impersonating sites like Solana and Luno. Because nothing is written to disk, it can sail right past EDR tools that are configured to only look for malicious files.
What people will get wrong
The mistake is to treat this as a novel threat instead of a basic visibility test. The focus will drift to the malvertising campaign or the crypto theme, but that’s a distraction.
The real issue is that many teams bought an EDR with “behavioral detection” and simply assumed it covered in-memory execution within the browser. This story is a perfect example of why that’s not a safe assumption. It’s not about a new, exotic attack; it’s about a gap in control validation that has likely existed for years.
Practitioner lens
This is really a story about your EDR’s actual capabilities versus its marketing slicks. The dashboard might be green, but that doesn’t mean it sees what’s happening inside a browser process.
What I’d want to know is, can we even detect this? Can your team build a detection rule for suspicious JavaScript execution chains in memory? Do you even get the necessary telemetry from the endpoint agent?
That sounds simple, but it’s where security programs break. This isn’t a tooling problem by itself. It’s an ownership problem. If no one on the security team is specifically tasked with validating browser-level threats, then no one owns the risk.
What to watch next
The question now is whether your team can prove what happened—or what would happen—on one of your endpoints. Use this story as an excuse to ask your endpoint team: “Can we see malicious JavaScript building a payload in a browser’s memory? Show me the log.”
The answer will tell you more about your security posture than any threat feed. This is less about panic and more about verification.
Source: Malicious sites use JavaScript to build malware in browser memory