SourTrade Malvertising Assembles Malware In-Browser, Evades Hash Detection

A persistent malvertising operation dubbed SourTrade has been quietly targeting retail traders and crypto investors since late 2024, impersonating trusted brands like TradingView, Solana, and Luno across 12 countries and 25 languages.

But what sets SourTrade apart isn’t just its scale; it’s the delivery mechanism. Instead of pushing a finished malware file, the campaign hands victims’ browsers a set of assembly instructions and lets the browser build the malicious executable in memory, on the spot.

This approach, detailed in new research from Confiant, defeats file-hash detection by design. Security tools scanning network traffic see only clean components. There’s no single “smoking gun” file traveling across the wire because the malware simply doesn’t exist until the victim’s own browser puts it together.

Malvertising Assembles Malware In-Browser

SourTrade’s ad campaigns run programmatically across Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Turkey, South Africa, Australia, and the UK, primarily concentrating on APAC and LATAM audiences.

By impersonating TradingView (charting), Solana (blockchain), and Luno (fiat-to-crypto exchange), the operators cover the entire retail trading journey from market analysis to investment to cash-out.

The landing pages use cloaking kits to fingerprint visitors. Researchers and automated scanners get served a blank, harmless page; real victims get a convincing replica money page.

Confiant also found Google Ads, Meta/Facebook, and Twitter/X pixel and conversion logic embedded in the malicious pages, suggesting the operators are running and measuring campaigns across all three ad ecosystems simultaneously.

The technical core of SourTrade unfolds in four stages:

Stage 1 – Setup: The page registers a ServiceWorker (for streamed file delivery) and spins up a SharedWorker from embedded JavaScript, preparing the browser to manage the download without any user click yet.
Stage 2 – Instructions, not files: The SharedWorker requests a /config endpoint, which returns not a malware file but a build recipe: a random seed and size, a byte-ordering “template,” and a URL pointing to a clean Bun JavaScript runtime hosted on separate infrastructure.
Stage 3 – In-memory assembly: The browser fetches the clean Bun runtime, generates a pseudorandom AES-CTR byte stream from the server-provided seed, and combines both with actor-supplied base64 blobs according to the template. This produces the PE header, section table, and a malicious .bun section containing JavaScriptCore bytecode assembled entirely in the victim’s memory.
Stage 4 – Same-origin delivery: The finished executable is handed to the ServiceWorker, which serves it back through a same-origin download path via a hidden iframe. To the browser and to Windows’ Mark of the Web logging it looks like a normal, safe same-domain download.

Because the AES-CTR seed and size rotate per session, every victim can receive a structurally unique executable even though the payload logic is the same. That single design choice undermines hash-based antivirus signatures at scale, since no two downloads necessarily produce an identical file.

It also creates blind spots for analysts. Reviewing the downloaded executable alone shows a legitimate-looking Bun binary; reviewing the network log shows a clean fetch to reputable-seeming infrastructure. Only tracing the full chain landing page, /config response, runtime fetch, and ServiceWorker handoff reveals the malicious assembly happening in between.

SourTrade isn’t entirely new. Bitdefender documented an earlier version of this cluster in September 2025, tied to fake “TradingView Premium” ads spreading across Meta, Google, and YouTube.

That earlier variant left Mark of the Web artifacts pointing to a GitHub-hosted StreamSaver.js helper URL. Confiant’s tracking through April 2026 shows the operators have since dropped that GitHub dependency in favor of the self-contained ServiceWorker/SharedWorker pipeline described above, a sign the group is actively refining its evasion techniques rather than running a static toolkit.

SourTrade illustrates a broader shift in malvertising tradecraft: moving detection logic client-side, where traditional network and file-based tooling has the least visibility.

For defenders, that means static hash blocklists and simple network inspection are no longer sufficient against campaigns engineered to look clean at every checkpoint except the final, ephemeral moment of execution.