Malicious sites use JavaScript to build malware in browser memory

Multiple active campaigns and breaches observed: a large malvertising operation serves fake Solana/Luno/TradingView pages with malicious JavaScript that assembles malware directly in browser memory; a Bing-adserved fake Claude installer distributes SectopRAT; hotel Wi‑Fi DNS changes are redirecting users to fake Microsoft 365 login pages to steal credentials; Clop ransomware is actively targeting Internet‑exposed PTC Windchill and FlexPLM instances for data theft/extortion; and threat actors are leveraging ShinyHunters breach data for sextortion scams. Separately, attackers are using AI tools/