Ad security platform Confiant identified a malvertising operation called SourTrade that instructs victims’ browsers to serve as on-device malware assembly pipelines, downloading encrypted code fragments and reconstructing a complete Windows executable in memory — never writing a finished malicious file to disk or transmitting a complete payload across the network.
How SourTrade’s Browser-Based Assembly Defeats File Detection
The core technique sets SourTrade apart from conventional malvertising campaigns. Malicious JavaScript served through the SourTrade ad network instructs the victim’s browser to download multiple encrypted component fragments from attacker-controlled infrastructure. A SharedWorker coordinates the download flow, collecting fragments in volatile browser memory and reassembling them into a Bun runtime executable. No single network request transmits a complete malicious file, and no finished malicious binary is written to disk at any point in the process. Antivirus and endpoint detection tools that rely on file-based scanning — whether at rest on disk or in network traffic — encounter only individual fragments that appear benign in isolation.
SharedWorker Reassembly and Randomized Config Parameters Defeat Signature Matching
The service worker managing the fragment download applies randomized /config parameters to each assembly session. Each assembled executable therefore carries a unique hash, defeating signature-based detection engines that operate by blocking known malicious file hashes. An engine that successfully identified and blocked a SourTrade sample from one victim would generate a different hash for the next, rendering the prior signature useless. The combination of in-memory assembly, fragment-level benign appearance, and session-level hash randomization means SourTrade produces no static artifact that conventional detection tools can build a durable signature against.
Solana, Luno, and TradingView Lures Filter Researchers and Target Crypto Investors
Fake websites impersonating Solana, Luno, and TradingView direct cryptocurrency investors and retail traders into the malvertising flow. A filtering system embedded in the campaign redirects security researchers, automated scanners, and bots to blank pages, preserving the operation’s lures from analysis while presenting the full attack flow only to profiled real users. This operational security mechanism means the malicious behavior is difficult to reproduce in controlled research environments, prolonging the campaign’s active lifespan. The targeting of cryptocurrency and retail trading users is consistent with SourTrade’s payload capabilities, which Bitdefender research documented to include credential theft, cryptocurrency wallet draining, and network traffic interception.
SourTrade’s Full Payload Capabilities and Twelve-Country Distribution
Bitdefender’s analysis of SourTrade’s final payload documents a broad capability set: network traffic interception through a proxy mechanism, theft of browser-stored cookies and saved passwords, keylogging, screenshot capture, cryptocurrency wallet draining, and persistence mechanisms that survive browser restarts. The combination of credential harvesting and cryptocurrency wallet access positions SourTrade as a financially motivated operation targeting the assets and account access most valuable to its victim demographic.
The campaign has been active since late 2024 and is localized to 25 languages across 12 countries, with primary distribution concentrated in Asia Pacific and Latin America. The scale of localization — 25 languages — indicates a well-resourced operation that invested in regional targeting rather than a broad-spectrum English-language campaign. Sustaining lure sites impersonating established trading platforms across 25 languages requires maintained translation workflows and market-specific content — operational overhead that separates SourTrade from less sophisticated malvertising campaigns. Security tools that rely on file-based detection or network-level hash matching provide substantially reduced protection against this browser-assembly approach, since the evasion operates at the architectural level rather than through obfuscation of a static payload. File-based defenses fail specifically because the complete Windows executable SourTrade assembles exists only in volatile browser memory, never written to disk, and therefore outside the file-system checkpoints that on-access antivirus tools rely on to detect threats at rest. The technique’s documented effectiveness over a multi-year active period suggests other malvertising operators will adopt similar assembly-in-memory delivery methods as defenders build signatures against conventional download-and-execute approaches.
