SourTrade Malvertising Campaign Builds Malware Inside Victim's Browser

A malvertising campaign dubbed 'SourTrade' has been weaponizing victims' browsers to construct malware in real-time since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages. The operation represents a significant evolution in evasion tactics that renders traditional antivirus detection ineffective.

The campaign distributes fake versions of popular cryptocurrency platforms including TradingView, Solana, and Luno.

In-Browser Assembly

Unlike conventional malvertising campaigns that deliver pre-built executables with static file hashes, SourTrade fragments the malicious payload and reconstructs it directly within the victim's browser memory. The campaign leverages JavaScript alongside SharedWorkers and ServiceWorkers—modern web APIs designed for background processing—to piece together a Windows executable on the client side.

This approach transforms the victim's browser into an impromptu compiler, assembling the final malware payload locally rather than downloading it as a complete file from a remote server.

Evasion Through Randomization

The technical sophistication of SourTrade lies in its ability to randomize the final file hash for every infection session. Because the executable is assembled in-memory with session-specific variations, each instance produces a unique cryptographic signature. This defeats static antivirus detection methods that rely on known malware hashes to identify threats.

Security researchers note that the malware uses a legitimate Bun runtime as its foundation, further complicating detection efforts by embedding malicious code within recognized, signed software components.

Broader Implications

The campaign demonstrates how attackers are increasingly exploiting legitimate web technologies for malicious purposes. ServiceWorkers and SharedWorkers, originally designed to improve web application performance and enable offline functionality, are now being repurposed to evade security controls.

This shift presents challenges for endpoint detection and response (EDR) tools, which may struggle to intercept threats that materialize only within browser memory rather than as discrete downloadable files. Traditional signature-based security approaches become largely ineffective when the malware's fingerprint changes with every infection attempt.

The SourTrade operation underscores the growing arms race between threat actors and security vendors, as attackers continue to find novel ways to weaponize legitimate infrastructure and APIs against unsuspecting users.