Malvertising Campaign Makes Browsers Build the Malware Themselves
SourTrade operation forces victims' browsers to assemble malicious software piece by piece.
1SourTrade Operation's Unique Method
The SourTrade malvertising operation employs a novel approach distinct from traditional malware distribution. Instead of downloading a complete malicious file, victims' browsers assemble the final Windows executable from delivered fragments. This technique, detailed by Confiant on July 23, 2026, has been active since late 2024. The campaign impersonates platforms like TradingView, Solana, and Luno, targeting cryptocurrency investors across 12 countries in 25 languages. Security experts emphasize that users should only download software from official sources to avoid such sophisticated attacks.
2Targeted Delivery and Defense Mechanisms
SourTrade's landing pages implement fingerprinting to selectively deliver payloads. While researchers and bots encounter empty pages, targeted users see convincing replicas of impersonated services. This evasion technique helps the malware avoid security analysts. Notably, the operation doesn't exploit browser vulnerabilities or remove Mark of the Web (MotW). Confiant's analysis documents the delivery mechanism but doesn't cover execution details. It remains unclear whether file downloads require user interaction or initiate automatically, adding to the attack's stealthiness.
3Technical Infrastructure and File Assembly
The SourTrade landing page begins preparing the delivery path before any download click occurs. It registers a page-scoped ServiceWorker at /sw.js, then creates a SharedWorker from embedded JavaScript. This worker requests /config to obtain a template, secondary runtime URL, and session-specific random values. The browser subsequently retrieves and decompresses a clean Bun runtime from a separate domain (e.g., purelogicbox[.]org). Base64 blobs in the configuration provide the Portable Executable (PE) header, section table, and malicious JavaScriptCore bytecode for app.js. Bun legitimately compiles applications into Windows executables using Apple's JavaScriptCore engine.
4Dynamic File Generation and Detection Challenges
SourTrade generates unique assembled files for each victim by rotating seeds and sizes in /config responses. This approach maintains the executable payload while altering file hashes, undermining simple hash-based detection. Michael Steele from Confiant's threat intelligence team notes, 'No finished malware ever exists on the network.' While complete binaries never appear, PE structures and bytecode transit as Base64 in /config requests. This methodology specifically circumvents security solutions relying on static file analysis, requiring more advanced behavioral detection techniques.
5Download Process and Source Obfuscation
After assembly, the page streams the executable to the ServiceWorker. A hidden iframe navigates to a same-origin URL, and the worker delivers the generated bytes with a Content-Disposition attachment header. The resulting MotW record attributes the download to the landing page rather than the separate domain providing the Bun runtime. While MotW remains present (potentially triggering Windows security warnings), many users ignore such prompts. This source masking complicates forensic investigations and attribution efforts.
6Operational Evolution and Historical Connections
SourTrade's current method evolved from earlier activity tracked by Confiant through April 30, 2026. Previous iterations loaded StreamSaver.js—an open-source streamed-download library—from its GitHub Pages address, making the download path traceable to GitHub. Current pages retain the streaming architecture but fetch resources from controlled infrastructure. Bitdefender documented related TradingView malvertising in September 2025, identifying final payloads as the JSCEAL/WeevilProxy stealer. While Confiant notes shared characteristics, it hasn't confirmed these samples carry the same payload.
7Detection Difficulties and Defense Recommendations
No software patch exists for SourTrade's technique. Confiant's analysis suggests unique per-session builds limit hash-based detection value, though attacker-controlled PE material still traverses networks. Defenders should examine the entire chain: from ad referrals and cloaked landing pages through /config requests, secondary-domain runtime fetches, and ServiceWorker downloads. No single network or file artifact proves decisive. Confiant published three SHA-256 hashes and 96 malicious domains but named no actors and stopped analysis at file disk-write. This underscores the need for comprehensive monitoring rather than relying on isolated indicators.
8Industry Impact and Long-Term Implications
The SourTrade operation represents a significant evolution in cyberthreat methodology. By distributing malware components for victim-side assembly, attackers bypass traditional security solutions effectively. This technique particularly endangers financial and cryptocurrency sectors, potentially causing substantial economic losses. Security teams must invest more in dynamic analysis and behavior-based detection. User education remains critical against such sophisticated attacks. The security community anticipates more complex variants emerging long-term, requiring continuous adaptation of defensive strategies across the cybersecurity landscape.