SourTrade Malvertising Builds Unique Malware Inside Victims’ Browsers to Evade Detection

SourTrade is a long-running malvertising operation that uses fake ads to lure cryptocurrency users toward convincing copies of trading and exchange platforms.

The campaign has been active since late 2024 and has targeted users across Asia-Pacific, Latin America, Africa, Australia, and Great Britain.

The attackers impersonate familiar brands, including TradingView, Solana, and Luno, then use visitor checks to keep researchers and automated systems away from the harmful content.

Confiant said in a report shared with Cyber Security News (CSN) that the people who do not meet the campaign’s targeting rules may only see a blank, harmless page.

The researchers found that SourTrade does not simply host a ready-made malicious file for victims to download. Instead, it makes the victim’s own browser assemble the final malware locally.

That approach makes the campaign harder to spot because security tools may see legitimate files, harmless code fragments, and ordinary-looking downloads rather than one clear malicious payload.

The activity also adds another risk for people who trust sponsored ads while searching for trading tools or crypto services.

SourTrade Malvertising

SourTrade’s landing pages prepare the download process before a victim clicks anything.

The pages register a ServiceWorker, a browser component that can control requests and downloads, then start a SharedWorker that receives instructions for constructing the final file.

Rather than sending an executable directly, the attackers provide a template, a clean Bun runtime, encrypted data, and session-specific values.

The browser combines those pieces in memory, creating a different Windows executable for each victim or session.

This method weakens traditional file-hash detection because a security product cannot easily match every newly created file to a known malicious sample.

It also complicates investigation, much like the techniques seen in browser cache malware attacks, where browser activity can become part of the delivery chain.

The final file is delivered through a same-origin browser download path controlled by the ServiceWorker.

To the user, the download can appear to come from the landing-page domain, while important parts of the build process originate from separate attacker-controlled infrastructure.

Ads, Cloaking, and Risk

The operation uses localized advertisements in English and the local languages of its selected regions.

Its fake pages imitate services used by retail traders, reaching people who may be searching for charts, blockchain projects, or ways to manage digital assets.

Researchers observed advertising and tracking logic associated with several large online advertising ecosystems on malicious pages.

This suggests the operators can measure traffic and refine their campaigns, a concern also reflected in recent Google Ads malware campaigns that steer users toward deceptive downloads.

Cloaking plays a central role in the campaign. SourTrade fingerprints visitors and gives suspected analysts, bots, or unwanted traffic a white page, while selected targets receive the fake platform page and its malware-building code.

Users should treat sponsored advertisements for financial tools with caution, especially when a page requests a software download.

Visiting services through saved bookmarks or manually typed addresses can reduce exposure to fake sites, while the broader malvertising threat landscape shows why ad-delivered threats remain a persistent security issue.

Organizations should examine browser downloads, advertisement referrals, ServiceWorker activity, and unusual connections to newly registered domains together rather than reviewing each signal separately.

Security teams should also block the indicators below where appropriate and investigate devices that interacted with them.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.