Malicious websites have been using a sophisticated technique to build and deliver malware directly within browser memory, evading traditional detection methods. A massive malvertising campaign has been underway since late 2024, targeting retail traders and crypto investors in 12 countries across Asia Pacific and Latin America.
The scheme relies on fake websites masquerading as legitimate financial platforms, such as Solana, Luno, and TradingView. These sites use malicious JavaScript code to instruct the browser to assemble malware from various components received during the attack process. The browser’s memory is used as a “local assembly pipeline” for the malware, making it difficult to detect.
A key aspect of this technique is the use of a service worker, which acts as a download manager and helps build the malware file incrementally. In the first stage, the page sets up a shared worker that assembles the malware from components received in subsequent steps. The threat actors then rotate parameters to ensure the resulting malware file has a unique hash, making it harder for static detection methods to identify.
Once the malware is built, the fake download page hands it over to the service worker and triggers a same-origin download path. From the browser’s perspective, the user is downloading an executable from the landing page domain, complete with a mark-of-the-web tag. This makes analysis more challenging, as no finished file is transmitted over the network.
The SourTrade campaign has been using this technique since April, after switching from the StreamSaver project on GitHub. Confiant researchers have found evidence supporting previous reports of a resilient malvertising campaign that used StreamSaver to distribute malware with capabilities such as keylogging, screenshot capture, and cryptocurrency wallet theft.
As retail traders and crypto investors are the primary targets, users in this demographic are advised to exercise caution when downloading financial or cryptocurrency apps from social media advertisements or sponsored search results. Instead, they should obtain executable files directly from official company websites, verifying the installer’s digital signature and publisher before running it.
This campaign highlights the importance of staying vigilant and testing security measures regularly. As Confiant notes, earlier variants of the SourTrade campaign used a different delivery method, demonstrating how threat actors adapt their tactics to evade detection. By understanding these techniques and implementing robust security practices, users can better protect themselves against such attacks.
Source: Bleeping Computer — 2026-07-25