SourTrade Malvertising Builds Unique Malware in Browsers to Evade Detection

Key Takeaways

• SourTrade is an ongoing malvertising operation that has been active since late 2024.
• It targets cryptocurrency users globally by impersonating legitimate trading platforms like TradingView, Solana, and Luno.
• The campaign uses a sophisticated evasion technique where the victim’s browser assembles the malware locally, rather than downloading a pre-built malicious file.
• This method makes detection challenging for traditional security tools that rely on file-hash matching.
• Users should exercise extreme caution with sponsored ads for financial services and always verify URLs directly.

A sophisticated malvertising campaign, dubbed SourTrade, is actively targeting cryptocurrency enthusiasts by leveraging fake advertisements that direct users to convincing replicas of popular trading and exchange platforms. This operation, which began in late 2024, has cast a wide net, impacting users across diverse regions including Asia-Pacific, Latin America, Africa, Australia, and Great Britain.

The attackers employ brand impersonation, mimicking well-known services such as TradingView, Solana, and Luno. A key element of their strategy involves rigorous visitor checks designed to deflect security researchers and automated analysis systems. According to Confiant, in a report shared with Cyber Security News (CSN), individuals who do not meet the campaign’s specific targeting criteria are often presented with a benign, blank page, effectively cloaking the malicious intent from unwanted scrutiny.

Researchers at Confiant have uncovered a particularly innovative technique employed by SourTrade: instead of serving a complete malicious executable for download, the campaign orchestrates the assembly of the final malware directly within the victim’s browser. This on-the-fly construction of malware locally within the browser poses significant challenges for conventional security detection mechanisms.

SourTrade Malvertising

The SourTrade attack chain initiates its malicious download process even before a user clicks. Upon landing on a deceptive page, the site registers a ServiceWorker, a browser component capable of intercepting and controlling network requests and downloads. Subsequently, a SharedWorker is activated, which then receives instructions necessary for constructing the final malicious file.

Rather than transmitting a single, identifiable executable, the attackers deliver a collection of disparate components: a template, a clean Bun runtime environment, encrypted data, and unique session-specific values. The victim’s browser then combines these elements in memory, yielding a distinct Windows executable for each individual user or session. This dynamic assembly process severely diminishes the effectiveness of traditional file-hash-based detection methods, as each generated malware instance possesses a unique signature.

This approach significantly complicates forensic investigations, mirroring tactics observed in browser cache malware attacks where browser activity itself becomes integral to the malware delivery. The completed malicious file is ultimately delivered through a same-origin browser download path, managed by the ServiceWorker. For the unsuspecting user, the download appears to originate from the legitimate-looking landing page domain, even though critical parts of the malware’s construction are sourced from separate, attacker-controlled infrastructure.

Ads, Cloaking, and Risk

SourTrade’s operators meticulously craft localized advertisements in English and the respective regional languages to maximize their reach. Their fake platforms are designed to appeal to retail traders, targeting individuals actively seeking charting tools, blockchain project information, or digital asset management services.

Analysts have noted the presence of advertising and tracking logic from several major online advertising ecosystems embedded within the malicious pages. This integration suggests that the attackers are actively measuring traffic and refining their campaigns, a concerning trend also evident in recent Google Ads malware operations that redirect users to deceptive software downloads.

A critical component of the SourTrade campaign is its sophisticated cloaking mechanism. The operation actively fingerprints visitors, presenting a harmless white page to suspected analysts, bots, or any traffic deemed undesirable. Conversely, identified targets are directed to the convincing fake platform, where the malware-building code is deployed.

What You Should Do

• Exercise Extreme Caution with Ads: Be highly suspicious of sponsored advertisements, particularly those promoting financial tools or cryptocurrency services, especially if they prompt a software download.
• Verify URLs Directly: Always access financial services and trading platforms by typing their official URLs directly into your browser or using trusted, saved bookmarks. Avoid clicking links from advertisements or suspicious emails.
• Monitor Browser Activity: Organizations should implement robust monitoring for unusual browser downloads, suspicious advertisement referrals, unexpected ServiceWorker activity, and connections to newly registered or unfamiliar domains. These signals, when analyzed collectively, can indicate a potential compromise.
• Block Known Indicators: Security teams should proactively block the provided Indicators of Compromise (IoCs) at network perimeters and endpoint protection systems. Any devices that have interacted with these indicators should be thoroughly investigated for compromise.
• Educate Users: Implement regular cybersecurity awareness training for employees, particularly those involved in financial trading or cryptocurrency, to highlight the dangers of malvertising and phishing tactics.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.