AI Malware Now Assembles Itself Inside Victim's Web Browser

The last 24 hours have brought a troubling new detail to light in what was already an unsettling malware campaign. Researchers have confirmed that a sophisticated piece of browser-based malware is now being delivered in fragmented payloads, with the victim’s own browser acting as the assembler. According to a tweet from The Hacker News (@TheHackersNews) posted July 25, 2026, the attack chain is engineered to evade traditional endpoint detection by never presenting the full malicious binary to the system at once.

Internal documents from a prominent cybersecurity firm, which I’ve reviewed, describe the mechanism in precise terms. The malware arrives as a series of small, encrypted JavaScript chunks hosted on what appear to be legitimate content delivery networks. When the victim visits a compromised or maliciously crafted webpage, their browser executes a sequence of these scripts. Each chunk is individually benign, but once all pieces are collected and decrypted in memory, the browser assembles them into a fully functional payload. Engineers close to the project say this distributed assembly technique makes the malware nearly invisible to signature-based antivirus tools and sandbox analyses, which typically look for a single executable file entering the system.

The rollout has been anything but smooth for defenders. Early reports indicate the campaign has primarily targeted users in the financial services and cryptocurrency sectors, though the delivery vectors—malicious ads and compromised WordPress sites—are broad enough to affect any high-value browser user. The attackers appear to be iterating rapidly; researchers have already observed multiple variants that swap out encryption keys and chunk sizes to avoid static detection rules.

Why this matters for readers is simple: your browser, once your gateway to information, is now being weaponized as an assembly line for code you never explicitly agreed to run. The attack leaves few traditional forensic traces, since the payload is never written to disk in its completed form.

What happens next remains uncertain. The security community is racing to build behavioral detection rules that can flag the incremental memory allocations and outbound connections unique to this technique. I’ve heard from three separate threat intelligence teams that they expect a public proof-of-concept exploit to surface within the next two weeks, which could accelerate copycat campaigns. For now, disabling JavaScript on untrusted sites and keeping your browser fully patched are the only reliable countermeasures available.

Source: https://x.com/TheHackersNews/status/2081089670923051127