A widespread malvertising campaign is using fake Solana, Luno, and TradingView pages to trick browsers into assembling malware directly in memory rather than downloading a finished payload. The operation, tracked by ad security firm Confiant, has been active since late 2024 and now spans 25 languages across 12 countries, concentrated in Asia Pacific and Latin America.
The campaign, dubbed SourTrade, relies on a filtering system that steers researchers, scanners, and security bots to blank pages while routing real retail traders and crypto investors to the malicious portals. Each fake site includes a convincing download button, but the actual delivery mechanism is far more elaborate than a simple file transfer.
Browser as an assembly line
According to Confiant, the landing page first registers a service worker that functions as a download manager, then spins up a shared worker acting as an assembly engine. That engine requests a special “/config” response from the page itself, using randomized seed and size parameters unique to each visitor session.
Rather than returning a normal file, the “/config” endpoint sends back a template and the instructions the browser needs to build the malware locally, combining remote components with locally generated bytes. The final payload is constructed from a clean version of the Bun executable, then handed to the service worker, which triggers a same-origin download.
From the browser’s perspective, the user appears to be downloading a legitimate executable from the landing page’s own domain, and the file even receives a mark-of-the-web tag despite some components originating elsewhere. Because no complete malicious file ever crosses the network in one piece, and each build produces a unique hash, the technique is designed to defeat both static detection and network-based inspection.
From StreamSaver to same-origin delivery
Confiant notes that earlier SourTrade variants used the open-source StreamSaver project to deliver payloads, but the operation switched to this same-origin ServiceWorker method in April. While Confiant did not disclose the current payload’s capabilities, it found evidence linking the campaign to a 2025 Bitdefender report on a resilient malvertising operation that used StreamSaver. Bitdefender’s analysis found that payload could intercept network traffic, harvest cookies and passwords, log keystrokes, capture screenshots, steal cryptocurrency wallet data, and establish long-term persistence.
Given the campaign’s focus on financial and crypto users, researchers recommend avoiding app downloads from social media ads or sponsored search results, obtaining installers only from official vendor websites, and verifying digital signatures and publisher information before execution.