"Security tools see only clean components. Network logs record a legitimate-looking download. The full attack is only visible when the entire execution chain is examined.”
SourTrade's browser-based assembly technique
Confiant researchers disclosed on July 23 that operators of the SourTrade malvertising campaign have shifted to a novel delivery model that assembles the final malware entirely inside a victim’s browser. Active since 2024, SourTrade impersonates well-known trading and cryptocurrency platforms — including TradingView, Solana and Luno — and uses malvertising lures to entice visitors toward sites that begin the stealthy delivery process.
How the malvertising lure and delivery chain operates
According to the Confiant write-up, visitors are drawn by advertising and landing pages that promise trading tips or cryptocurrency giveaways. When a user reaches one of these pages, JavaScript delivered by the site "prepares the browser for the constituent parts of the malware delivery." The site does not distribute a complete malware binary over the network; instead it delivers assembly instructions, retrieves a clean file from separate infrastructure, then directs the browser to piece together and execute the final payload in memory on the victim’s machine.
Why this technique evades file-fingerprinting and network detection
The operators intentionally avoid serving a stable, finished malware file over the network. Confiant explains that "no finished malware ever exists on the network," a design explicitly intended to counter file fingerprinting and other defenses that flag known malicious binaries. Michael Steele, a threat intelligence researcher at Confiant, summarized the operational advantage: "Security tools see only clean components. Network logs record a legitimate-looking download. The full attack is only visible when the entire execution chain is examined."
How the browser-built payload works and what it accomplishes
After the browser receives the assembly instructions, remote components are fetched and assembled in memory, then executed. Because the payload is constructed in the browser, protections that rely on detecting suspicious files on disk or known binary signatures can be bypassed; to those protections, the resulting activity may appear as if it should be trusted and safe even though the installed program is an infostealer. Confiant’s researchers note an additional operational benefit for SourTrade: the output can vary by victim or session, reducing the reuse of a single binary and further complicating detection.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Confiant’s findings imply detection must move beyond single-download signatures and toward examining full execution chains and browser-built behaviors, because "the full attack is only visible when the entire execution chain is examined," Michael Steele warned.
- Enterprises and procurement leaders: Organizations that host or advertise trading-related content — and those whose customers include investors or traders — should note that SourTrade impersonates platforms named in the report (TradingView, Solana and Luno) and uses lures centered on trading tips and cryptocurrency giveaways, increasing the risk that customer-facing ad inventory could be leveraged to reach end users.
- End users, particularly investors and traders: Visitors who follow malvertising offers tied to trading tips or cryptocurrency giveaways may be directed to pages that trigger in-browser assembly of an infostealer without a conventional malicious binary ever traversing the network.
Confiant characterizes SourTrade as a prolific and evolving malvertising operation, and researchers warned that the campaign remains widespread and continuing to change. By shifting the construction of malware into the browser and fragmenting the delivery chain across otherwise innocuous components, SourTrade reframes the forensic challenge: the attack can look benign until analysts can reconstruct the entire sequence of JavaScript instructions, remote components and in-memory assembly that produced the infostealer.
That shift leaves an open operational question: if no finished malware crosses the network and the output can vary by session or victim, how quickly will defenders adapt monitoring and forensics to follow the full execution chain rather than individual artifacts? For now, Confiant’s report stands as a warning that the malvertising battlefield has moved deeper into the browser — and that SourTrade continues to refine its tactics.
