SourTrade Malvertising Campaign Builds Windows Malware Inside Victims’ Browsers

A malvertising campaign tracked as SourTrade is using victims’ browsers to assemble Windows executables from separate components, rather than distributing a completed malware file from a single server. Confiant said the operation has been active since late 2024 and has targeted retail traders and cryptocurrency users in 12 countries through pages impersonating TradingView, Solana and Luno.

The campaign begins with a cloaked landing page that fingerprints visitors. Researchers, automated scanners and other unwanted visitors may receive a blank page, while selected targets are shown a convincing imitation of a legitimate service. The pages can start preparing the download before a user explicitly requests a file.

Browser-based assembly process

According to Confiant, the page registers a ServiceWorker and creates a SharedWorker from JavaScript embedded directly in the page. The SharedWorker retrieves configuration data containing a build template, session-specific values and a URL for a clean Bun runtime. Bun is a legitimate JavaScript runtime capable of packaging applications as standalone Windows executables.

The configuration also includes Base64-encoded Portable Executable structures and JavaScriptCore bytecode. The worker combines those materials with selected portions of the Bun runtime and a pseudorandom byte stream generated using AES in counter mode. Because the seed and other build parameters can change for each session, the resulting files may have different hashes while retaining the same underlying payload logic.

The completed bytes are streamed back through the ServiceWorker and delivered through a hidden iframe with an attachment response. Confiant said the technique does not exploit a browser vulnerability and does not remove Windows’ Mark of the Web identifier. Its analysis covered delivery and assembly, not whether execution occurs automatically or requires the victim to open the downloaded file.

Detection and defensive guidance

The campaign evolved from an earlier version that used StreamSaver.js hosted on GitHub Pages. The newer implementation retains elements of that streaming design but hosts the required code within the operation’s own infrastructure.

Confiant linked the activity to an earlier TradingView malvertising cluster, but said it has not confirmed that the three analyzed samples contain previously reported payloads such as JSCEAL or WeevilProxy. Defenders should examine the complete sequence—including ad referrals, cloaked pages, configuration requests, secondary-domain runtime downloads and ServiceWorker activity—rather than relying only on file hashes. Users should obtain trading and wallet applications directly from official vendor websites.