SourTrade turns browsers into covert malware factories

A malvertising operation targeting traders and cryptocurrency users is assembling malicious Windows software inside victims’ browsers, allowing each downloaded file to evade conventional fingerprint-based security checks.

The campaign, known as SourTrade, uses sponsored advertisements and imitation websites resembling TradingView, Solana and Luno. Rather than transmitting a complete malicious program, the sites send instructions and separate components that the browser combines into an executable file on the user’s device.

The technique represents a significant change in malware delivery. Network security products inspecting downloaded files may encounter only legitimate software, small data fragments or encrypted instructions. The malicious executable takes its final form in browser memory, after those elements have crossed the network separately.

SourTrade has operated since late 2024 and has targeted users in 12 countries through advertisements and websites presented in 25 languages. Observed markets include Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Türkiye, South Africa, Australia and Great Britain.

The operators appear focused on retail investors who routinely search online for market-analysis tools, cryptocurrency services and trading applications. Users following promoted links can be directed to carefully designed replicas of familiar platforms and encouraged to download what appears to be legitimate software.

TradingView, Solana and Luno have not been identified as sources of the malware. Their branding is being copied by attackers seeking to exploit trust in established financial and cryptocurrency services.

The landing pages employ cloaking technology to distinguish likely victims from automated scanners, advertising reviewers and cybersecurity analysts. Selected users see a convincing product page, while suspected researchers or bots may receive an empty or harmless page. This selective delivery makes the campaign harder to reproduce and investigate.

Browser scripts begin preparing the delivery mechanism even before a user presses the download button. The page registers a ServiceWorker, a legitimate browser feature capable of managing network requests and streamed content. It also creates a SharedWorker from JavaScript embedded within the page.

The SharedWorker requests a configuration file containing an assembly template, session-specific random values and the location of a legitimate Bun runtime. Bun is a high-performance JavaScript and TypeScript development toolkit. There is no evidence that its developers or distribution infrastructure were compromised.

The browser retrieves the clean Bun component and combines it with attacker-controlled data, a Windows Portable Executable structure and malicious JavaScriptCore bytecode. It also generates pseudorandom data through AES counter-mode operations, using values supplied for that particular session.

These changing bytes make the resulting executable different for each victim or download. Its cryptographic hash therefore varies, weakening security systems that depend on matching files against lists of known malware fingerprints.

Once assembly is complete, the ServiceWorker supplies the finished stream through a download address belonging to the imitation website. The browser presents it as an ordinary attachment originating from the same domain, although important components came from separate infrastructure.

The downloaded program does not automatically execute merely because the landing page was opened. Infection generally requires the user to download and run the resulting Windows executable. Entering credentials, approving cryptocurrency transactions or connecting a wallet to an imitation platform could create additional exposure.

The campaign’s websites contain advertising and tracking elements associated with Google Ads, Meta platforms and X. Those components indicate that the operators may be measuring traffic and refining their targeting across several advertising ecosystems, although their presence alone does not establish that every platform carried malicious advertisements.

Earlier versions used StreamSaver-based methods and could leave download-origin records pointing towards GitHub-hosted helper infrastructure. Variants observed after April shifted towards same-origin delivery, giving the final file a more ordinary-looking browser provenance record.

SourTrade exposes weaknesses in security models centred on inspecting complete files during transmission. Effective detection may require endpoint and browser telemetry capable of connecting suspicious advertising redirects, ServiceWorker registration, unusual runtime downloads and the subsequent creation of executable files.