A widespread malvertising operation has been actively deploying malicious JavaScript on deceptive webpages masquerading as legitimate financial platforms such as **Solana**, **Luno**, and **TradingView**. This campaign, first observed in late 2024, targets users across 12 countries, predominantly in the Asia Pacific and Latin American regions, with content localized into 25 languages. **Confiant**, an ad security platform, highlights the campaign's unique approach: it utilizes the web browser itself as a "local assembly pipeline" for the malware. This method ensures that fully formed malicious files are never transmitted over the network, significantly complicating detection and analysis efforts.  The operation employs a sophisticated filtering system. Only genuine targets—retail traders and crypto investors—are directed to the malicious pages. Security researchers, scanners, and bots are rerouted to blank pages, making initial discovery and analysis more challenging. While the fake portals feature a download button, the process is far from straightforward. A **ReactJS** library embedded on the landing page initiates a managed download flow, a technique typically used for legitimate file transfers.  ### The In-Browser Assembly Process **Confiant**'s analysis details a multi-stage assembly process: 1. **Service Worker Registration**: The page first registers a service worker, which functions as a download manager, facilitating the incremental construction of the malware file. 2. **Shared Worker Initialization**: A shared worker is then set up. This acts as the core engine responsible for assembling the malware from various components received during subsequent steps. 3. **Dynamic Configuration Request**: The landing page requests a '/config' response from itself via the shared worker. This request includes randomized and session-specific seed and size parameters. By rotating these parameters, threat actors ensure that each resulting malware file possesses a unique hash, effectively bypassing static signature-based detection. 4. **Component Assembly**: The '/config' response provides a template and the necessary inputs for the browser to build the file locally. Remote components and locally generated bytes are then combined to create the malicious payload, often starting from a clean version of the **Bun** executable. 5. **Same-Origin Delivery**: Once the final malware executable is built, it is handed to the initial service worker, triggering a same-origin download path. From the browser's perspective, the user is downloading an executable from the landing page's domain, complete with the 'mark-of-the-web' tag, despite components originating from external sources. This method's primary advantage is the absence of a finished malicious file traversing the network, making it significantly harder for traditional security solutions to detect. ### Evolution of the Campaign and Payload Capabilities Earlier iterations of the **SourTrade** campaign utilized the **StreamSaver** project on **GitHub** for payload delivery. However, since April, the operation has transitioned to the more stealthy same-origin **ServiceWorker** delivery method. While **Confiant** researchers have not explicitly detailed the current payload, they found evidence linking **SourTrade** to a **Bitdefender** report from 2025 concerning a resilient malvertising campaign that also leveraged **StreamSaver**. **Bitdefender**'s findings on that payload indicated extensive capabilities, including: * Interception of all user network traffic (acting as a proxy) * Collection of cookie and password data * Keystroke logging and screenshot capture * Theft of cryptocurrency wallet data * Establishment of long-term persistence ### Recommendations for IT Security Professionals and Users Given that the **SourTrade** campaign specifically targets retail traders and crypto investors, vigilance is paramount. Users are strongly advised to: * **Avoid Downloads from Ads**: Refrain from downloading financial or cryptocurrency applications via social media advertisements or sponsored search results. * **Verify Official Sources**: Always obtain executable files directly from the company's official website. * **Check Digital Signatures**: As an additional layer of security, verify the installer's digital signature and publisher before executing any downloaded software.