SourTrade: The Campaign That Turns Your Browser into a Malware Factory

In late July 2026, security researchers exposed a clever malvertising campaign named SourTrade that had been active since late 2024. This operation targets cryptocurrency investors and financial traders across twelve countries by setting up deceptive ads that impersonate well-known trading platforms such as TradingView, Solana, and Luno. What makes SourTrade exceptionally dangerous is not merely the cloned websites, but the novel way it delivers its payload to the victim. Instead of transmitting a pre-compiled, fully formed virus file over the network where modern security tools would easily intercept it, the campaign forces the victim's own web browser to assemble the malicious Windows executable file entirely inside the computer's memory.

How the Assembly Process Works

By downloading individually harmless components and combining them locally, the SourTrade operation ensures that no finished malware ever crosses the internet intact. When a user clicks a malicious advertisement, the landing page immediately profiles the visitor to determine if they are a real target or an automated security scanner. Security bots and researchers are shown an empty or harmless page, while genuine traders are directed to a convincing replica of the impersonated platform. Before the user even interacts with a download button, the landing page silently prepares a background pipeline by registering background scripts within the browser. The browser then fetches raw configuration templates containing encoded headers alongside a completely clean, legitimate developer tool called the Bun runtime from a secondary domain.

Once these components are retrieved, the browser uses an embedded script to execute a byte-copy recipe that stitches the clean software, random noise bytes, and hidden malicious code into a fully functioning Windows application. Because every single victim receives a unique combination of random seed values and byte patterns, the resulting executable has a completely distinct digital fingerprint. Once the assembly process finishes, a subtle prompt triggers a file download directly to the victim's machine. After the user opens the newly created file, the embedded code activates to deploy stealthy information stealers such as WeevilProxy, which quietly harvest digital crypto wallets, saved browser credentials, and active banking session cookies.

Why Traditional Security Misses It

Traditional perimeter defenses fail against SourTrade because the network traffic appears entirely harmless to firewalls and web filters, which only observe legitimate software tools and random text data streams moving across the connection. Furthermore, because the malware binary is constructed dynamically inside each victim's browser memory, no two victims ever download the exact same file structure. This completely neutralizes classic hash-based antivirus blocklists that rely on recognizing known malicious file signatures. Finally, by specifically impersonating high-value cryptocurrency and trading tools, the campaign successfully targets individuals who maintain active financial assets for immediate and high-impact exfiltration.

How to Protect Your Team

Defending against client-side assembly operations requires a shift from network-level inspection to behavioral endpoint monitoring. Security teams must ensure that endpoint defense agents actively monitor child-process creation coming directly out of browser download directories, specifically looking for unexpected executions of developer tools or custom binaries launching from temporary folders. Organizations should also enforce aggressive ad-blocking and strict web filtering across all corporate devices to dismantle the malvertising entry point before the malicious landing page can load its scripts. Lastly, users must be trained to never download software or trading applications from sponsored search engine results or online advertisements, opting instead to navigate directly to official provider websites.