GoKawiilA massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.
The operation has been active since late 2024 and is localized to 25 languages in 12 countries, primarily in Asia Pacific and Latin America.
A filtering system ensures that only real targets (retail traders and crypto investors) land on the malicious pages, while researchers, scanners, and security bots are redirected to blank pages.
Ad security platform Confiant says that the campaign's design stands out through its use of the web browser as "a local assembly pipeline" for the malware.
Although the fake portals feature a download button, a ReactJS library on the landing page prepares the browser for a managed download flow, a process typically used for handling various types of file transfers.
Fake TradingView site
Source: Confiant
According to Confiant's analysis, the page first registers a service worker, which acts as a download manager and helps build the malware file incrementally.
In the first stage, the page sets up a shared worker that acts as an engine that assembles the malware from components received in the next steps of the attack.
The researchers say that in the second stage "the landing page uses its SharedWorker to request itself for a ‘/config’ response" with seed and size parameters that are randomized and specific for each session.
... continue reading