SourTrade: Malicious Sites Use JavaScript to Assemble Malware Directly in Browser Memory

Researchers at Confiant have published an analysis of SourTrade, a sophisticated malvertising campaign that has been running since late 2024, targeting retail traders and cryptocurrency investors across 25 languages and 12 countries. The campaign's most notable technical characteristic: the final malware payload is never transmitted over the network. Instead, JavaScript running in the victim's browser assembles the malware from components and delivers it as a same-origin download — making it effectively invisible to network-based security controls.

The Attack Chain

SourTrade lures victims to convincing lookalike websites impersonating well-known platforms:

• Solana (cryptocurrency ecosystem)
• Luno (cryptocurrency exchange)
• TradingView (trading and charting platform)

The campaign uses a filtering mechanism that distinguishes real victims from security researchers and automated scanners. Anyone identified as a bot or researcher is redirected to a blank page. Only legitimate targets see the malicious content.

Once a real target lands on a SourTrade site, the following pipeline executes entirely in the browser:

1. Service Worker Registration

A ReactJS library loaded by the fake site registers a service worker that acts as a background download manager. The service worker persists across page navigation and intercepts network requests.

2. Shared Worker Assembly

A SharedWorker component begins receiving malware components from the server in subsequent requests. Each request uses a randomized seed and size parameter unique to the session, generating unique hashes that defeat static signature detection — no two requests look the same.

3. In-Memory Reconstruction

Received components are combined with locally generated bytes to reconstruct a malicious payload from a clean Bun executable instance. The finished binary is assembled entirely in browser memory from pieces, none of which individually constitute detectable malware.

4. Same-Origin Delivery

The service worker triggers a same-origin download, delivering the assembled executable to the victim. As Confiant researchers note: "From the browser's point of view, the user is downloading an executable from the landing page domain."

The mark-of-the-web tag is appended to the download, making it appear to originate from the legitimate-looking fake domain.

Why This Evades Detection

Traditional malware delivery puts a complete malicious binary on a network-accessible server. Network security tools, endpoint detection, and antivirus scanners can inspect that binary in transit or on disk.

SourTrade's technique eliminates the network-transmissible binary entirely:

• No malware traverses the network — only innocuous-looking JavaScript and fragments
• Unique hashes per session prevent static signature matching
• Same-origin download bypasses browser protections that flag cross-origin executables
• Researcher filtering prevents automated analysis tools from triggering the payload

Earlier variants of the campaign (pre-April 2026) used the StreamSaver GitHub project for file delivery. Since April 2026, the operation switched entirely to same-origin ServiceWorker delivery, increasing stealth further.

Malware Capabilities

Based on Bitdefender's 2025 analysis of related campaigns, the delivered malware includes:

• Full proxy and traffic interception
• Cookie and saved password harvesting
• Keylogging and screen capture
• Cryptocurrency wallet theft
• Persistent access mechanisms

The campaign's focus on crypto and trading platform impersonation — Solana, Luno, TradingView — directly aligns with the malware's cryptocurrency theft capabilities, targeting users most likely to have high-value wallet access.

Geographic and Demographic Targeting

SourTrade currently operates across 12 countries with content in 25 languages, primarily targeting the Asia Pacific and Latin America regions. The multi-language, multi-region scale indicates a well-resourced, organized operation rather than an opportunistic campaign.

How to Protect Yourself

1. Download applications exclusively from official websites — verify the URL matches the genuine domain exactly before downloading anything
2. Verify digital signatures on any executable before running it, regardless of how you obtained it
3. Use a browser extension that blocks malicious scripts and advertisement networks
4. Enable browser security features — modern browsers warn about suspicious downloads; do not bypass these warnings
5. Be skeptical of trading and crypto platform "downloads" presented on web pages — legitimate platforms do not require you to download executables from a website to trade

Key Takeaways

• SourTrade is a malvertising campaign active since late 2024 targeting crypto and trading users
• Malware is assembled in browser memory using JavaScript service workers — the finished binary never hits the network
• Fake Solana, Luno, and TradingView sites are the delivery mechanism
• Researcher/bot filtering prevents automated detection tools from triggering the payload
• No network signature to detect — endpoint behavior monitoring is the primary detection layer
• Cryptocurrency theft, keylogging, and persistent access are primary payload capabilities

References

• BleepingComputer — Malicious sites use JavaScript to build malware in browser memory
• Confiant — SourTrade Campaign Analysis
• Bitdefender — Related malvertising campaign analysis (2025)