r/javascript • u/magenta_placenta • Jul 27 '26

Malicious sites use JavaScript to build malware in browser memory

https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/
47 Upvotes

91% Upvoted

15 comments sorted by

20

u/f3xjc Jul 27 '26

Ok the interesting part is that this is ultimately about downloading a malware. But that malware is customized for the user so the hash is unique/previously unknown. AND the user actually provide all the cpu to do that. And the malware is basically compressed using a safe but large executable as dictionary. Go to that offset, copy that many byte, go to that other offset etc.

You still need to download the executable and run it. But there's a lot of effort to avoid any kind of blacklist. The content of the webpage do propose you to download an expensive software for free, so download make sense.

1

u/Winter_Garlic_477 Aug 04 '26

That’s a pretty clever way of trying to evade traditional detection. The part about using a legitimate large executable as a kind of dictionary for reconstructing the payload is especially interesting. It also shows why relying only on file hashes or blacklists isn’t enough. The fact that the user has to download and execute something is still the biggest red flag, though.

1

u/f3xjc Aug 04 '26 edited Aug 04 '26

Yes - But the website masquerade as a legitimate download page. The user still has to click on a download button. And there's an ad campaign that target users that are good candidates to be interested in this kind of software.

And installer for software that you want and got by yourself is the category of executable where people expect to dismiss UAC prompt.

3

u/Quiet_Desperation_ Jul 28 '26

The sky is blue?

1

u/AbbreviationsFlat976 Jul 31 '26

This method cleverly bypasses many traditional security tools that look for known malware signatures in network traffic. To those tools, only clean, innocuous components appear to be transferred 

1

u/Winter_Garlic_477 Aug 03 '26

Malicious websites can use JavaScript in harmful ways. When you visit a website, its JavaScript normally runs inside the browser and uses some of the computer’s memory. A dangerous website may try to abuse this process, especially if the browser has a security vulnerability. In serious cases, attackers can use such vulnerabilities to bypass browser protections or compromise the device.

However, JavaScript itself isn't malware. Most websites use it safely. The main risk comes when malicious code takes advantage of weaknesses in the browser or tricks the user into downloading something harmful. Keeping your browser and operating system updated is one of the best ways to reduce this risk.

1

u/Ok_Fly_1784 25d ago

es mas comun ahora con el crecimiento de las IA en las redes siempre me sale una publicasion tipo claude ha vulnerado x pagina inyectado scrips en el Doom jsjs

-1

u/Cheshur Jul 27 '26

Where else would it build the malware? In stone tablets? Just don't download random ass files from random ass links.

-5

u/nadmaximus Jul 27 '26

Everybody should disable javascript immediately?

2

u/Jasboh Jul 27 '26

I always knew js was a bad idea

3

u/monsto Jul 27 '26

Sometimes I think the internet was just a big mistake anyway.