SourTrade Malvertising Campaign Builds Unique Malware Inside Victim Browsers

A sophisticated malvertising operation dubbed 'SourTrade' weaponizes victims' browsers to assemble unique Windows executables on the fly, representing a technical escalation that renders traditional hash-based blacklisting obsolete. Active since late 2024, the campaign targets retail traders and crypto investors across 12 countries.

Attackers impersonate trusted brands like TradingView, Solana, and Luno to lure victims to fraudulent trading platforms. Targets span APAC, LATAM, Africa, and Western markets, including Japan, South Korea, Brazil, Nigeria, and Great Britain.

Browser as Build System

SourTrade employs a multi-stage assembly process that moves malware construction into the victim's browser memory. The operation registers a ServiceWorker, fetches a legitimate Bun standalone runtime, and uses a JSON assembly profile to stitch together PE headers and malicious bytecode delivered from command-and-control servers.

Rather than delivering a static malicious file, the campaign fetches the clean Bun runtime and combines it with C2-delivered blobs and random padding to create a bespoke binary for each victim. The malware is diversified using rotated AES-CTR seeds and sizes, ensuring each executable has a unique hash to defeat hash-based detection.

"SourTrade turns the browser itself into a malware build system, deliberately sidestepping the industry's reliance on hash-based file fingerprints and traditional network-centric detection," according to GBHackers reporting on Confiant research.

Cloaking and Evasion

The operation employs a cloaking kit to fingerprint visitors, serving benign pages to security researchers and bots while showing fraudulent trading platforms to actual targets. This technique helps the campaign evade analysis and extend its operational lifespan.

By weaponizing the browser as an assembly line, attackers bypass security sandboxes and endpoint detection systems that rely on recognizing known malicious signatures. No two victims receive the same file, and no single component of the delivery—the Bun runtime, the config JSON, or the random bytes—is inherently malicious on its own.

Industry Implications

Malvertising has evolved from simple redirects to complex delivery chains. Previous campaigns, such as attacks impersonating TradingView, used tools like StreamSaver.js to manipulate the Mark of the Web. SourTrade represents a significant escalation by moving the actual build process into browser memory, utilizing legitimate developer tools to blend in with normal network traffic.

The technique presents challenges for defenders, as network-centric detection and hash-based blacklisting cannot effectively identify threats where each victim receives a uniquely constructed executable. Security teams will need to shift toward behavioral analysis and browser-based anomaly detection to counter this emerging threat model.