A massive malvertising operation dubbed SourTrade is using fake cryptocurrency and trading websites to turn victims’ browsers into local malware assembly lines. Threat actors leverage JavaScript, service workers, and a clean copy of the Bun runtime to build malicious executables entirely inside browser memory. The campaign has been active since late 2024 and targets retail traders and crypto investors across 12 countries and 25 languages.
What Happened: SourTrade Malvertising Campaign Hijacks Browsers to Build Malware
The SourTrade operation impersonates legitimate platforms including TradingView, Solana, and Luno to trick users into downloading what appears to be authentic trading software. However, the download button does not deliver a pre-built file. Instead, the victim’s browser assembles the malware locally using a multi-stage JavaScript pipeline.
Ad security platform Confiant detailed the campaign in a July 2026 report, describing it as a shift from traditional malware delivery to “browser-assembled” payloads. The technique eliminates the need to transmit a finished executable over the network, which significantly complicates network-level detection and static analysis.
The landing pages use a filtering system to distinguish real targets from security researchers and automated scanners. Suspected bots receive a blank page, while retail traders and crypto investors are served a convincing replica of the impersonated platform.
Technical Details of the Browser Assembly Pipeline
The SourTrade campaign uses a sophisticated multi-stage delivery chain that treats the browser as a local compiler rather than a simple download client. The process unfolds across several coordinated steps.
Stage One: Service Worker Registration
When a target lands on the fake page, a ReactJS library registers a service worker that acts as a download manager. This worker coordinates the entire assembly process and manages the final file delivery to the user.
Stage Two: SharedWorker as Assembly Engine
The page then sets up a SharedWorker that functions as the core assembly engine. This worker receives remote components and combines them with locally generated bytes to construct the final payload.
Stage Three: Polymorphic Configuration
The landing page requests a /config endpoint from itself, passing randomized seed and size parameters that are unique per session. By rotating these values, the threat actors ensure each generated malware sample has a unique hash, bypassing signature-based detection.
Stage Four: Payload Construction
Remote components retrieved through the configuration response, combined with locally generated bytes, are used to build the malicious executable from a clean version of the Bun runtime. The resulting file is then handed back to the service worker for delivery.
“From the browser’s point of view, the user is downloading an executable from the landing page domain,” Confiant researchers explained. The Mark-of-the-Web tag is applied normally, despite some components originating from different sources.
Business and Operational Impact
The SourTrade campaign poses significant risks to both individual investors and enterprise environments.
- Credential theft: The payload intercepts network traffic and steals cookies, passwords, and session data.
- Cryptocurrency wallet compromise: The malware targets crypto wallet files and private keys.
- Keylogging and surveillance: The payload records keystrokes and captures screenshots.
- Long-term persistence: The malware establishes mechanisms to survive reboots and remain active.
- Enterprise lateral movement: Compromised developer or trader workstations can serve as footholds for broader network intrusion.
Because the malware is assembled locally rather than downloaded as a complete file, traditional network security tools may fail to detect the malicious activity. The polymorphic nature of the payloads further complicates endpoint detection and response efforts.
Mitigation and Recommendations
Organizations and individual users should take immediate steps to reduce exposure to browser-assembled malware campaigns.
Immediate Actions for Defenders
- Never download trading or cryptocurrency software from advertisements, sponsored search results, or social media links. Obtain executables exclusively from official vendor websites.
- Verify digital signatures and publisher information before running any downloaded executable.
- Disable unnecessary browser features that enable service workers and background processes for untrusted sites.
- Implement network segmentation to limit the impact of compromised workstations.
Enterprise Security Measures
Security teams should monitor for anomalous browser activity, including unusual service worker registrations and outbound connections initiated from browser processes. Endpoint detection and response solutions should be tuned to detect in-memory payload construction and process injection behaviors.
Furthermore, user awareness training should emphasize the risks of malvertising and the importance of verifying software sources. The SourTrade campaign demonstrates that even savvy users can be deceived by highly convincing fake platforms.
Bottom line: The SourTrade operation marks a troubling evolution in malvertising. By using the browser as a local assembly pipeline, threat actors can bypass traditional detection mechanisms and deliver unique, evasive payloads to every victim. Verify every download source and treat ads with extreme skepticism.
Incident Summary
| Campaign Name: | SourTrade |
| First Observed: | Late 2024 |
| Impersonated Platforms: | TradingView, Solana, Luno |
| Primary Targets: | Retail traders and cryptocurrency investors |
| Geographic Reach: | 12 countries, 25 languages (primarily Asia Pacific and Latin America) |
| Disclosed By: | Confiant (July 2026) |
| Payload Capabilities: | Credential theft, crypto wallet theft, keylogging, screenshots, persistence |
References
- BleepingComputer, “Malicious sites use JavaScript to build malware in browser memory,” July 25, 2026, https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/ (accessed July 27, 2026).
- Confiant Blog, “SourTrade: Browser-Assembled Malware,” July 2026, https://blog.confiant.com/p/sourtrade-browser-assembled-malware (accessed July 27, 2026).
- The Hacker News, “Malvertising sends malware in pieces, then makes the browser build the executable,” July 25, 2026, https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html (accessed July 27, 2026).
- Bitdefender Labs, “The scam that won’t quit: Malicious TradingView premium ads jump from Meta to Google and YouTube,” 2025, https://www.bitdefender.com/en-us/blog/labs/the-scam-that-wont-quit-malicious-tradingview-premium-ads-jump-from-meta-to-google-and-youtube (accessed July 27, 2026).
