Users may have just gotten used to the idea of ransomware —the threat shows no signs of going away — but cybercriminals are trying to stay two steps ahead by changing the form of the malware along the way. Their latest effort involves the use of a popular and legitimate coding language.

BleepingComputer reported that a new threat discovered by security researchers, dubbed RAA ransomware, is made entirely of JavaScript (JS) code. The malware is presenting itself as a standard JavaScript file.

RAA Ransomware Brings Its Own Library

The source said the JS install uses CryptoJS. This open-source library is fairly easy to use and leverages algorithms such as AES to encrypt files. The library gives RAA the chops it needs to execute attacks — chops JavaScript doesn’t usually have.

The researchers believe RAA ransomware is distributed via emails, with the malware posing as attachments with a .js file name. Once a file is opened, it starts its malicious process by scanning the victim machines and then encrypting select files.

It will then demand a ransom of around $250. To make matters more obnoxious, it also installs Pony, a well-known password stealer, from the poisoned JS file to extract even more information from the victim.

Is JavaScript the Future of Ransomware?

Although this was a one-of-a-kind discovery for security researchers, malware-makers have been creating attacks using JavaScript for some time. None of these past threats were strictly JS code, but some did use popular JavaScript frameworks for their exploits. So while this is the first time security professionals noted ransomware entirely composed of JavaScript out in the wild, it’s likely not the last.

“JS-based attacks are definitely becoming more popular, but for the most part ransomware has still been compiled code. I think we are seeing a lot of JS-based installers lately simply because they are easier to write and debug,” Lawrence Abrams, author of the BleepingComputer report on the ransomware, told Threatpost. “Also, by obfuscating them, it makes it harder for them to be analyzed by AV scanners.”

JS may prove to be a potent entry point for malware developers. With the language’s relative ease of coding and debugging, more cybercriminals will likely catch on to the attack vector. The only way to beat the threat is to follow security best practices and stay vigilant regarding the opening of suspicious or unknown emails.