Malvertising Campaign Assembles Malware Inside Browser Memory to Evade Detection

A sophisticated malvertising operation has been targeting retail traders and cryptocurrency investors since late 2024, using malicious JavaScript on counterfeit financial websites to construct malware directly inside a victim's browser memory — a technique that leaves no finished executable traveling across the network.

The campaign, dubbed SourTrade by ad security platform Confiant, operates fake versions of well-known platforms including Solana, Luno, and TradingView. It is localized across 25 languages in 12 countries, with activity concentrated in Asia Pacific and Latin America.

At the core of the scheme is what Confiant describes as using the web browser itself as "a local assembly pipeline" for the malware. Rather than delivering a finished malicious file, the landing pages deploy a ReactJS library that orchestrates a multi-stage build process within the browser.

According to Confiant's analysis, the process begins when the landing page registers a service worker that acts as a download manager. A shared worker is then initialized to serve as an assembly engine, drawing on components passed through subsequent stages of the attack.

In the second stage, that shared worker requests a "/config" response containing seed and size parameters that are randomized and unique to each session. Confiant explains that this endpoint "is an assembly response rather than a normal download response," returning a template and the inputs the browser needs to build the file locally.

By rotating these session-specific parameters, the threat actors ensure that the assembled malware file carries a unique hash on every run, allowing it to evade static detection tools. Remote components and locally generated bytes are combined to produce a malicious payload derived from a clean version of the Bun executable.

Once assembled, the fake download page hands the finished file to the service worker and triggers a same-origin download path. "From the browser's point of view, the user is downloading an executable from the landing page domain," Confiant researchers noted, and the file receives a mark-of-the-web tag even though portions of it originated elsewhere.

The campaign also employs a filtering layer that redirects security researchers, automated scanners, and bots to blank pages — ensuring that only genuine targets encounter the malicious content.

Earlier variants of SourTrade relied on the StreamSaver open-source project on GitHub to deliver payloads. Since April, the operation shifted to the same-origin ServiceWorker delivery method, underscoring the operators' ongoing effort to harden the campaign against detection and takedown.

Confiant did not disclose the exact nature of the current payload, but cited a 2025 Bitdefender report on a related campaign that used StreamSaver to distribute malware with similar delivery mechanics. Bitdefender found that payload was capable of intercepting all user network traffic as a proxy, harvesting cookies and passwords, logging keystrokes, capturing screenshots, stealing cryptocurrency wallet data, and establishing long-term persistence on infected machines.

Confiant advises traders and crypto investors to avoid downloading financial or cryptocurrency applications from social media advertisements or sponsored search results, and to obtain executables only from official company websites. Researchers also recommend verifying an installer's digital signature and publisher before running any downloaded file.

The campaign highlights an escalating trend of malware delivery techniques engineered to defeat network-layer defenses, with operators increasingly shifting the assembly work to the endpoint itself — where conventional perimeter controls have little visibility.

Disclaimer