"The web browser [is] a local assembly pipeline" for malware, Confiant researchers wrote — and the operators behind a widespread malvertising effort have built an attack that proves the point. Active since late 2024 and localized to 25 languages across 12 countries, the campaign uses fake Solana, Luno and TradingView pages to instruct browsers to assemble malware entirely in memory before handing a unique executable back to the user’s machine.
ServiceWorker and SharedWorker: the browser as an assembly pipeline
Confiant's analysis lays out a multi-stage, in-browser build process. The landing page registers a service worker that functions as a download manager; that service worker helps assemble the malware file incrementally. A SharedWorker is set up as an engine that takes components retrieved later and stitches them together.
Rather than delivering a completed file, the page requests a session-specific “/config” response from itself. Confiant says that “‘/config’ is an assembly response rather than a normal download response. It returns a template and the inputs the browser needs to build the file locally.” Those seed and size parameters are randomized per session, and remote components plus locally generated bytes are combined — starting from a clean Bun executable — to construct the final malicious payload inside the browser.
SourTrade’s targeting: fake Solana, Luno and TradingView pages, and filtered traffic
The campaign presents convincing facsimiles of legitimate crypto and trading portals, including Solana, Luno and TradingView, and shows a download button to its victims. Confiant says the operation filters visitors: real targets — retail traders and crypto investors — are allowed onto the malicious pages, while researchers, scanners and security bots are redirected to blank pages. The effort is geographically focused, primarily in Asia Pacific and Latin America, and localized in 25 languages across 12 countries.
Evasion techniques: randomized assembly, same-origin delivery, and no finished file on the wire
The operators have layered several evasions. By rotating seed and size parameters for each session, the resulting executable gets a unique hash intended to bypass static detection. Confiant notes the operational advantage: because "no finished file is transmitted over the network," conventional file‑based inspection is less likely to catch the payload and analysis becomes more difficult.
Earlier variants of the campaign — identified as SourTrade — used the StreamSaver project on GitHub to deliver payloads. Since April, Confiant reports, the operation switched to a same-origin ServiceWorker delivery method. That change matters because, as Confiant researchers explain, "From the browser’s point of view, the user is downloading an executable from the landing page domain," and the mark-of-the-web tag is added even when some components originate elsewhere. The net effect is a download flow that looks legitimate to the browser while evading network-level detection.
Payload capabilities and corroborating intelligence
Confiant did not disclose the exact nature of the payload in their report, but they found evidence supporting a Bitdefender report from 2025 about a resilient malvertising campaign that used StreamSaver to distribute malware. Bitdefender reported that the payload included capabilities to:
- intercept all user network traffic (acting as a proxy)
- collect cookie and password data
- record keystrokes (keylogging) and take screenshots
- steal cryptocurrency wallet data
- establish long-term persistence
The combination of in-browser assembly, randomized build parameters and same-origin handoff creates a delivery chain that complicates both static signature detection and dynamic analysis.
What this means for retail traders, security teams, and researchers
Retail traders and crypto investors — the campaign’s intended victims — are explicitly warned: avoid downloading financial or cryptocurrency apps from social media advertisements or sponsored search results. Confiant advises getting executable files from the company’s official website and, before running installers, verifying the installer’s digital signature and publisher.
Security teams face a detection challenge. The source material includes a pointed statistic: "Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen." The report of in-browser assembly underscores the need to exercise layered detection beyond file-based signatures, and to validate download provenance at the browser and endpoint layers.
Researchers and automated scanners must also adapt: the campaign deliberately redirects non-target traffic to blank pages, meaning standard crawl-and-analysis techniques can be fed false negatives. Reproducing the campaign’s environment — including geography, language, and user-agent filtering — will be necessary to observe the full attack chain.
Confiant’s findings describe a deliberate shift in delivery tactics: from using a third‑party helper (StreamSaver) to exploiting browser service and shared workers to create a same-origin download that looks legitimate at the point of handoff. That engineering choice — combined with per-session randomized assembly — raises the bar for detection and analysis while leaving defenders and users with practical steps they can take now: source installers from official domains and verify digital signatures, and for defenders, test detection coverage against in-memory and assembled-executable techniques.
