A Sneaky Malware Campaign Exploits Browser Memory to Evade Detection
Malicious websites are using a clever tactic to assemble malware directly in browser memory, evading detection and making it harder for security experts to analyze. The campaign, dubbed SourTrade, has been active since late 2024 and targets retail traders and crypto investors in Asia Pacific and Latin America.
The operation works by creating fake webpages that mimic popular platforms like Solana, Luno, and TradingView. These pages use JavaScript to instruct the browser to assemble malware, rather than downloading a finished file from a server. This approach makes it more challenging for security tools to detect the threat, as no suspicious files are transmitted over the network.
According to Confiant’s analysis, the landing page first registers a service worker that acts as a download manager. The service worker then requests itself for a ‘config’ response with seed and size parameters that are randomized for each session. This ensures that the resulting malware file has a unique hash, making it harder for security tools to detect.
The researchers found that the threat actors use a technique called same-origin ServiceWorker delivery method, which allows them to build the malicious payload from locally generated bytes and remote components. The advantage of this approach is that it makes detection less likely and analysis more challenging.
Confiant notes that earlier variants of the SourTrade campaign used the StreamSaver project on GitHub to deliver the malicious payload. However, since April, the operation has switched to the same-origin ServiceWorker delivery method. While Confiant researchers do not reveal the nature of the payload, they found evidence supporting a Bitdefender report in 2025 about a resilient malvertising campaign that used StreamSaver to distribute malware with capabilities such as intercepting user network traffic, collecting cookie and password data, and stealing cryptocurrency wallet data.
The SourTrade campaign’s design stands out for its use of the web browser as a “local assembly pipeline” for the malware. This approach is a clear indication that threat actors are becoming more sophisticated in their tactics, making it essential for security teams to stay vigilant.
To protect themselves from this type of attack, users engaged in retail trading and crypto investing should be cautious when downloading financial or cryptocurrency apps from social media advertisements or sponsored search results. Instead, they should get executable files directly from the company’s official website and verify the installer’s digital signature and publisher before running it. By being aware of these tactics and taking necessary precautions, individuals can reduce their risk of falling victim to this type of malware campaign.
As a security-aware individual, it is essential to stay informed about emerging threats and take proactive measures to protect yourself and your organization. By understanding how threat actors operate and using best practices for security, you can minimize the risk of being caught off guard by these types of attacks.
Source: Bleeping Computer — 2026-07-25