Malware Built Right in the Browser: How the SourTrade Campaign Works

Confiant, a company specializing in advertising security, has dissected an unusual malvertising campaign dubbed SourTrade. The attackers set up fake Solana, Luno, and TradingView pages on which malicious JavaScript turns the visitor's browser into a “local assembly line” for a ready-to-run executable.

Selecting the victims

The campaign has been active since late 2024, is localized into 25 languages, and covers 12 countries, primarily in the Asia-Pacific region and Latin America. The filtering system lets only genuine targets through to the malicious pages — individual traders and crypto investors — while redirecting researchers, scanners, and defensive bots to blank pages.

Assembly in memory

The fake site has a download button, but what lies behind it is not an ordinary file. A ReactJS library prepares the browser for a “managed” download: first a service worker is registered to act as a download manager, then a shared worker is spun up — a kind of build engine. In the second stage, the page uses SharedWorker to request from itself a /config response containing seed and size parameters that are random and unique to each session.

According to the researchers, /config returns not a file but a template and source data from which the browser assembles the malware on the spot. Remotely fetched components and locally generated bytes are appended to a clean copy of the Bun executable — and that is how the final malware is born. The page then hands the finished file off to the service worker and triggers a download within the same domain.

From the browser's point of view, the user is simply downloading an executable from the site they visited; it is even tagged with the mark-of-the-web, even though some of the components came from other sources. Rotating the parameters guarantees a unique hash for every file, which defeats static detection. The technique's main advantage is that the finished file is never transmitted over the network in its entirety — making it harder to detect and analyze.

Early versions of the campaign used the StreamSaver project from GitHub for delivery, but since April the operation has switched to delivery via ServiceWorker within the same domain.

What the malware does

Confiant does not disclose the nature of the final payload, but its findings echo a 2025 report from Bitdefender. According to Bitdefender, the malware can intercept all network traffic by acting as a proxy, steal cookies and passwords, log keystrokes and take screenshots, siphon off crypto wallet data, and maintain long-term persistence on the system.

The researchers advise against downloading financial and cryptocurrency apps from social media ads or paid search results, recommend obtaining files only from official websites, and suggest checking the digital signature and publisher before launching them.

Source: Bleeping Computer