**Understanding the SourTrade Malvertising Campaign: How Browsers Are Turned into Download Handlers**
A sophisticated malvertising campaign dubbed **SourTrade**, actively targeting retail traders and cryptocurrency investors across 12 countries and 25 languages, has been detailed by security firm Confiant. Operating since late 2024 and impersonating major platforms like TradingView, Solana, and Luno, the campaign employs a unique technical method that avoids delivering a complete, pre-built malicious file. Instead, it orchestrates the victim’s own browser to assemble the final Windows executable using a legitimate runtime.
The process begins when a user lands on a compromised or maliciously advertised page. The page immediately registers a page-scoped ServiceWorker and builds a SharedWorker from embedded JavaScript. This worker communicates with a `/config` endpoint, which returns a template, a secondary runtime URL (often a legitimate Bun runtime from `purelogicbox[.]org`), and session-specific random values. The browser then downloads a clean Bun runtime – a legitimate tool for building JavaScriptCore-based applications.
The malicious payload is not a single file but is instead delivered as Base64-encoded fragments: a Portable Executable (PE) header, section table, and a `.bun` section containing malicious JavaScriptCore bytecode for `app.js`. Using AES-CTR, the worker generates a large pseudorandom byte stream. Following the template – essentially a “byte-copy recipe” – the browser combines ranges from the Bun runtime, the generated stream, and the attacker-controlled executable material to assemble the final Portable Executable (PE) file.
Crucially, each victim can receive a unique, dynamically assembled file. The random seed and size parameters in the `/config` response ensure that while the resulting executable’s payload code remains consistent, its hash changes every time. As Confiant’s Michael Steele noted, **”No finished malware ever exists on the network.”** The network traffic contains components and instructions, but never a complete, pre-assembled malicious binary. The final executable, once built, is delivered to the browser via a hidden iframe with a `Content-Disposition` attachment header, making the user’s browser the origin of the download, effectively masking the true source. The “Mark of the Web” (MotW) attribute, a Windows security feature indicating a file came from the internet, is retained from the initial landing page but isn’t removed or bypassed.
This method represents a significant evolution in malvertising evasion. Unlike older techniques relying on browser vulnerabilities or simple hash-based blocking, SourTrade’s reliance on legitimate tools and on-the-fly assembly creates a moving target. While earlier campaigns using StreamSaver.js left a traceable download path pointing to open-source libraries, the current variant uses a custom streaming architecture, further complicating detection. Although linked by Confiant to earlier clusters associated with payloads like JSCEAL and WeevilProxy (tracked by Bitdefender and Check Point), the exact capabilities of the current build – such as credential theft or remote access – remain unconfirmed, as analysis stops at the point the file lands on the user’s disk.
The core defense remains user vigilance: **only install trading or wallet software directly from the official vendor’s website.** Never download executables from pop-up ads, social media posts, or unsolicited recommendations.
### FAQ
**Q: What is SourTrade?**
A: SourTrade is a sophisticated malvertising campaign that hijacks a user’s browser to dynamically assemble a malicious Windows executable (PE file) on the victim’s machine, rather than serving a pre-built malware file. It targets cryptocurrency investors by impersonating platforms like TradingView.
**Q: How does SourTrade work?**
A: The campaign uses a multi-step process:
1. A landing page registers a ServiceWorker and creates a SharedWorker.
2. The worker fetches a configuration file (`/config`) from the attacker’s server.
3. The config provides a template, a URL for a legitimate Bun runtime, and random seeds.
4. The browser downloads the clean Bun runtime.
5. The worker uses AES-CTR to generate a random byte stream.
6. It combines the runtime, the random stream, and malicious bytecode according to the template to assemble a unique, malicious `.exe` file.
7. The assembled file is downloaded by the user, often disguised as a legitimate trading application.
**Q: Why is this method considered sophisticated?**
A: The method is evasive because it doesn’t deliver a single, identifiable malware file. Instead, it sends the “blueprint” and components, letting the victim’s computer build the final payload. This means hash-based detection is largely ineffective, as each victim receives a file with a unique hash.
**Q: What can I do to protect myself?**
A: The most effective defense is to be highly skeptical of ads, especially those on social media platforms like Twitter (X), YouTube, or Telegram, that promise access to trading platforms. **Always download trading software directly from the official, verified website of the broker or exchange.** Do not click links in unsolicited messages or ads.
**Q: Which platforms are being impersonated?**
A: The campaign has impersonated TradingView, Solana, and Luno.
**Q: Does this attack use a browser zero-day?**
A: No. The attack chain does not rely on a browser vulnerability. It exploits the normal functionality of browsers (Service Workers, Shared Workers, and the ability to compile and run code via Bun) combined with social engineering.
### Conclusion
The SourTrade campaign highlights a potent shift in malvertising tactics, moving away from crude, one-size-fits-all malware delivery toward a more targeted, dynamic, and evasion-focused strategy. By leveraging legitimate development tools like Bun and the browser’s own worker architecture, attackers can generate unique, polymorphic payloads that evade traditional security measures. This attack underscores that the strongest defense remains user education and strict software sourcing habits. In an era of increasingly complex threats, the rule of thumb remains as critical as ever: **if an offer or access point seems too good to be true, or appears out of context, it almost certainly is. Never download software from an ad—always go directly to the source.**
