Malvertising Evolves As Browsers Now Build Malware From Scratch

Cybersecurity researchers have uncovered a disturbing new malware delivery technique that turns a victim’s own web browser into an unwitting assembly line for malicious executables. The campaign, documented by threat intelligence firm Confiant on July 23, 2026, represents a significant evolution in how attackers distribute malware through online advertisements — and it highlights a broader, accelerating threat landscape that shows no signs of slowing down.

The Browser-as-Assembler Technique

The operation, tracked as a malvertising campaign running since late 2024, impersonates well-known cryptocurrency and trading platforms including TradingView, Solana, and Luno. It targets retail traders and cryptocurrency investors across 12 countries and operates in 25 languages, making it one of the most globally distributed malvertising campaigns on record.

What sets this campaign apart from conventional malware distribution is its delivery mechanism. Rather than serving a complete, pre-built malicious file from a fixed URL — a method that security tools can identify through known file hashes — the attackers deliver the malware in pieces and let the victim’s browser assemble the final executable on the fly.

Here is how the attack chain works:

• Malicious advertisements redirect users to convincing landing pages that fingerprint visitors, showing suspected security researchers and bots an empty page while presenting real targets with a copy of the impersonated service.
• A ServiceWorker and SharedWorker are registered directly in the browser, with the SharedWorker’s source code embedded in the page itself so it never appears as a separate network fetch.
• A clean Bun runtime — a legitimate JavaScript runtime built on Apple’s JavaScriptCore engine — is downloaded and decompressed from a secondary domain. Bun legitimately supports compiling applications and bytecode into standalone Windows executables, which the attackers exploit.
• Base64-encoded configuration blobs supply the Portable Executable (PE) header, section table, and malicious JavaScriptCore bytecode that constitute the actual payload.
• A pseudorandom byte stream generated using AES in counter mode (AES-CTR) is combined with the Bun runtime and attacker-controlled material following a template-based byte-copy recipe, producing a unique executable for each victim.

The result is a file that, as Confiant’s Michael Steele noted, means “no finished malware ever exists on the network.” Each victim receives a different assembled binary, since rotating the seed and size in each response changes the file’s hash while retaining the executable payload code. This effectively neutralizes traditional hash-based detection systems.

Why Hash Detection Falls Short

The technique represents a fundamental challenge to how the security industry detects and blocks malware. Traditional antivirus and endpoint protection platforms rely heavily on file hashes — unique digital fingerprints of known malicious files. When no two victims download the same file, that entire defensive layer becomes effectively useless.

However, the evasion is not absolute. Confiant’s own analysis acknowledges that the attacker-controlled PE material and bytecode still cross the network, meaning that content-aware inspection tools and behavioral analysis platforms can still identify the malicious components even if the assembled file is unique each time.

A Fragmented and Expanding Ransomware Landscape

While the browser-assembler technique represents an alarming innovation in malware delivery, it is occurring against a backdrop of intensifying ransomware activity. A new report from Black Kite, published on July 24, 2026, reveals a ransomware landscape that has become more fragmented, more numerous, and more prolific than at any point in recent years.

Between April 2025 and March 2026, 61 new ransomware groups entered the market — averaging more than one new group per week. By June 2026, the number of active threat groups had reached 146. The reporting period recorded a total of 7,551 ransomware victims, with ransomware disclosures increasing by 60% in the second half of the reporting period compared to the first.

“Previous years were often defined by a dominant ransomware group or a single major event,” said Ferhat Dikbiyik, Chief Research and Intelligence Officer at Black Kite. “This year was different. We saw more groups enter the market, while established operators continued to scale and attack volume accelerated in the second half.”

Who Is Being Targeted

The Black Kite report reveals clear patterns in ransomware victim demographics:

• Geography: The United States accounted for 49.3% of all observed victims, remaining the most targeted country. European markets saw significant increases, with the four most affected European countries collectively recording more than 250 additional victims. Parts of Asia recorded some of the largest percentage increases.
• Industry: Manufacturing remained the most targeted sector, followed by professional, scientific, and technical services. Construction, healthcare, wholesale trade, finance and insurance, and retail trade formed the next tier of heavily targeted industries.
• Organization size: Organizations with annual revenue between $50 million and $100 million accounted for the largest share of victims. Targeting patterns differed across revenue bands, with some groups running high-volume campaigns against accessible organizations while others concentrated on higher-value targets.
• Timing: Weekdays accounted for 84.1% of all victim postings, with Wednesday recording the highest activity and Sunday the lowest.

The Supply Chain Attack Vector

One of the most concerning findings in the Black Kite report is the growing role of third-party services as an attack vector. Organizations with strong internal controls are being compromised through their supply chain connections. SaaS platforms, ERP systems, CRM applications, OAuth tokens, remote access tools, and connected business software have all become common attack paths for ransomware operators.

This means that even organizations with robust cybersecurity postures can be exposed through a vulnerable vendor, partner, or service provider. Security misconfigurations, internet-facing remote access, software vulnerabilities, stealer logs, credential-related findings, and botnet activity all appeared across the victim population studied by Black Kite.

Defensive Strategies for an Evolving Threat Landscape

The combination of browser-assembled malware delivery and an expanding, fragmented ransomware landscape demands a shift in how organizations approach cybersecurity. Several key strategies can help mitigate these evolving threats:

1. Reduce Reliance on Hash-Based Detection

As the malvertising campaign demonstrates, attackers can now produce unique malware binaries for every victim. Organizations should invest in behavioral analysis, content-aware inspection, and threat intelligence platforms that identify malicious components and behaviors rather than relying solely on known file signatures.

2. Harden the Supply Chain

Given the prominence of third-party services as ransomware attack vectors, organizations should conduct thorough risk assessments of all vendors and service providers. This includes evaluating SaaS platforms, ERP systems, and any externally managed tools that connect to internal infrastructure. Third-party risk programs centered solely on U.S. exposure profiles may leave organizations blind to growing European and Asian risks.

3. Educate Users About Malvertising

The browser-assembler campaign relies on users clicking through malicious advertisements to reach convincing landing pages. The most effective defense against this particular attack is simple but critical: download trading and wallet software only from the vendor’s own official website, never from an advertisement. User awareness training should specifically address the dangers of malvertising and the sophistication of modern fake landing pages.

4. Implement Robust Access Controls

With OAuth tokens, remote access tools, and connected business software serving as common ransomware attack paths, organizations should implement strong access controls including multi-factor authentication, least-privilege access policies, and regular credential rotation. Internet-facing remote access points should be minimized and closely monitored.

5. Maintain Comprehensive Backups

Ransomware remains a persistent threat, and no defensive strategy is foolproof. Maintaining offline, tested backups remains the most reliable way to recover from a ransomware incident without paying a ransom. Organizations should regularly test their backup restoration processes and ensure that backups are isolated from networks that ransomware could reach.

Looking Ahead

The cybersecurity landscape in mid-2026 is defined by two concurrent trends: increasingly sophisticated evasion techniques that challenge traditional detection methods, and a proliferation of ransomware actors that makes the threat environment more chaotic and harder to predict. The emergence of browser-assembled malware proves that attackers continue to find creative ways to abuse legitimate software and browser capabilities, while the growth in ransomware groups shows that the business model of extortion remains highly profitable for cybercriminals.

Neither trend shows signs of reversing. Security teams must adapt by moving beyond signature-based defenses, taking supply chain risk seriously, and maintaining the foundational hygiene of access controls, user education, and backup integrity. The threats are evolving — and defensive strategies must evolve with them.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous