SourTrade Malvertising Campaign Uses Browser-Based Assembly to Deliver Malware

Severity
Medium

Detail

Cybersecurity researchers at Confiant have identified a malvertising campaign named SourTrade that constructs malicious Windows executables directly within victims’ browsers instead of downloading a complete malware file from a remote server. Active since late 2024, the campaign impersonates cryptocurrency and trading platforms including TradingView, Solana, and Luno, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages.

The campaign employs visitor fingerprinting to distinguish legitimate targets from researchers and automated analysis systems. Suspected researchers and bots are presented with blank pages, while selected victims receive convincing replicas of the impersonated services.

How?

When a victim visits a malicious landing page, the browser begins preparing the malware delivery process before any download action occurs. The page registers a ServiceWorker and creates a SharedWorker from JavaScript embedded within the page. The SharedWorker retrieves a /config response containing a template, a secondary runtime URL, and session-specific values.

The browser then downloads and decompresses a legitimate Bun runtime from a secondary domain. The configuration also contains Base64-encoded Portable Executable (PE) components and a .bun section containing malicious JavaScriptCore bytecode.

Using AES in Counter Mode (AES-CTR), the browser generates a pseudorandom byte stream and combines portions of the legitimate Bun runtime, generated data, and attacker-supplied executable components according to instructions contained in the configuration template. This process assembles a unique Windows executable for each victim.

After assembly, the executable is streamed to the ServiceWorker, which delivers the generated file through a hidden iframe using a Content-Disposition attachment response. The resulting Mark of the Web (MotW) identifies the landing page as the download source, while MotW remains intact.

Impact

The campaign creates a different executable for each victim by varying the session-specific seed and size values, resulting in unique file hashes while preserving the same executable payload. According to Confiant, this approach reduces the effectiveness of simple hash-based detection methods because no complete malware binary is delivered directly over the network.

The campaign has been linked to previously observed TradingView-themed malvertising activity documented by Bitdefender in September 2025. Confiant identified similarities in campaign characteristics and executable construction but did not confirm that the current samples deliver the same malware payloads previously associated with that activity. Confiant did not attribute the campaign to a specific threat actor and concluded its analysis at the point where the generated executable is written to disk.

Recommendation

Confiant stated that there is no software patch available for this technique. Organizations and users should:

• Install trading and cryptocurrency wallet applications only from the official vendor websites rather than advertisements.
• Monitor the complete attack chain, including advertisement referrals, cloaked landing pages, /config requests, secondary-domain Bun runtime downloads, and ServiceWorker-based file delivery, instead of relying solely on individual file hashes or network artifacts.
• Review the published SHA-256 hashes and malicious domains released by Confiant as indicators of compromise.

Conclusion

The SourTrade campaign demonstrates a malvertising technique that assembles malicious Windows executables directly within the victim’s browser by combining a legitimate Bun runtime with attacker-controlled executable components. By generating unique executables for each session and avoiding the delivery of a complete malware binary over the network, the campaign reduces the effectiveness of hash-based detection and highlights the importance of monitoring the entire delivery chain rather than individual artifacts.

Source

https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html
https://blog.confiant.com/p/sourtrade-browser-assembled-malware