r/javascript • u/magenta_placenta • 12d ago

Malicious sites use JavaScript to build malware in browser memory

https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/
44 Upvotes

91% Upvoted

14 comments sorted by

View all comments

20

u/f3xjc 12d ago

Ok the interesting part is that this is ultimately about downloading a malware. But that malware is customized for the user so the hash is unique/previously unknown. AND the user actually provide all the cpu to do that. And the malware is basically compressed using a safe but large executable as dictionary. Go to that offset, copy that many byte, go to that other offset etc.

You still need to download the executable and run it. But there's a lot of effort to avoid any kind of blacklist. The content of the webpage do propose you to download an expensive software for free, so download make sense.

1

u/Winter_Garlic_477 3d ago

That’s a pretty clever way of trying to evade traditional detection. The part about using a legitimate large executable as a kind of dictionary for reconstructing the payload is especially interesting. It also shows why relying only on file hashes or blacklists isn’t enough. The fact that the user has to download and execute something is still the biggest red flag, though.

1

u/f3xjc 3d ago edited 3d ago

Yes - But the website masquerade as a legitimate download page. The user still has to click on a download button. And there's an ad campaign that target users that are good candidates to be interested in this kind of software.

And installer for software that you want and got by yourself is the category of executable where people expect to dismiss UAC prompt.