A malvertising campaign called SourTrade has been using victims’ browsers to assemble Windows malware from pieces since late 2024, with a technical analysis by Confiant saying the operation impersonated TradingView, Solana and Luno across 12 countries and 25 languages.
KEY FACTS
- Campaign SourTrade delivers malware in parts rather than as one finished file.
- Targets Retail traders and cryptocurrency investors were the main audience.
- Method The page uses a ServiceWorker and SharedWorker to build the download chain.
- Payload Base64 data in the configuration supplies PE structures and malicious JavaScriptCore bytecode.
- Scope Confiant said it tracked activity in 12 countries and 25 languages.
The report said the landing pages fingerprint visitors and show suspected researchers and bots a blank page while selected targets see a convincing copy of the impersonated service. The flow does not rely on a browser exploit and does not remove Mark of the Web, and the final file is built from a template, a clean Bun runtime and attacker-controlled executable material.
The disclosure said the browser fetches and decompresses a clean Bun runtime from a secondary domain, then combines that with session-specific values from /config. Each victim can receive a different assembled file, which changes the hash while keeping the payload code intact.
The current chain keeps the streaming-download design seen in earlier activity, but no longer fetches StreamSaver.js from GitHub Pages. The report said the recorded download path now points to the landing page, not the separate domain that supplied the runtime, and the MotW marker remains in place.
The Hacker News said it found no mention of Bun in the September 2025 post tied to the earlier TradingView malvertising cluster, so the exact overlap with past stealer campaigns remains unclear. Confiant published three SHA-256 hashes and 96 malicious domains, but named no actor and stopped its analysis when the file reached disk.
WHY IT MATTERS
The approach makes simple file hashes less useful because the malware can be rebuilt differently for each session. Defenders are advised to review the full chain from the ad click to the `/config` request and the ServiceWorker download, since no single network or file artifact tells the whole story.