Malicious sites use JavaScript to build malware in browser memory