SourTrade Malvertising Builds Unique Malware Inside Victims’ Browsers to Evade Detection
The SourTrade malvertising campaign employs a novel technique where victims' browsers assemble malware locally, making it harder for security tools to detect.
The long-running SourTrade malvertising campaign, active since late 2024, continues to target cryptocurrency users by impersonating popular brands such as TradingView, Solana, and Luno. Attackers leverage deceptive advertisements to lure unsuspecting victims into visiting convincing replicas of legitimate trading and exchange platforms. A key characteristic of this campaign is its sophisticated evasion technique, which involves assembling the final malware payload directly within the victim's browser, thereby circumventing traditional file-hash detection methods.
SourTrade's operational strategy focuses on making the malware delivery process as stealthy as possible. The campaign actively screens visitors, presenting a blank or harmless page to researchers, automated systems, or any traffic deemed undesirable. This cloaking mechanism ensures that the malicious infrastructure remains hidden from scrutiny. For targeted victims, the process begins even before they click on any advertisement. The landing pages are designed to initiate a download process by registering a ServiceWorker, a browser component capable of intercepting and managing requests and downloads.
Further complicating detection, SourTrade utilizes a SharedWorker to receive instructions for constructing the final malicious file. Instead of delivering a pre-compiled executable, the attackers provide a template, a clean runtime environment (specifically, the Bun runtime), encrypted data, and session-specific values. The victim's browser then combines these components in memory, effectively creating a unique Windows executable for each individual user or session. This dynamic assembly process significantly weakens traditional file-hash-based security solutions, as each generated file is distinct and unlikely to match known malicious signatures.
The method of malware assembly within the browser also poses challenges for incident response and investigation. It shares similarities with other browser-based attack vectors where the browser's own activity becomes integral to the malware delivery chain. The final executable is delivered through a same-origin download path controlled by the ServiceWorker, making the download appear legitimate and originating from the landing page's domain, even though critical components of the build process are sourced from separate attacker-controlled infrastructure.
The campaign's reach is global, with observed activity targeting users across Asia-Pacific, Latin America, Africa, Australia, and Great Britain. The advertisements are localized, appearing in English and the native languages of the targeted regions. The fake landing pages meticulously imitate the interfaces of services commonly used by retail traders, aiming to ensnare individuals searching for trading charts, blockchain projects, or digital asset management tools.
Analysis of the malicious pages revealed the presence of advertising and tracking logic associated with major online advertising networks. This integration suggests that the operators are capable of sophisticated traffic analysis and campaign refinement, a tactic also seen in other malvertising operations that redirect users to deceptive downloads. The use of cloaking is paramount, ensuring that only the intended targets are exposed to the malware assembly code.
Security researchers advise users to exercise extreme caution when encountering sponsored advertisements for financial tools, particularly those prompting software downloads. Employing safe browsing habits, such as using bookmarks or manually typing website addresses, can mitigate exposure to fake sites. Organizations are encouraged to monitor browser downloads, ad referral traffic, ServiceWorker activity, and unusual connections to newly registered domains in conjunction, rather than analyzing these signals in isolation. Blocking identified indicators of compromise (IoCs) and investigating affected devices are crucial steps for defense.