A malvertising campaign identified as SourTrade is employing a novel method where victims’ browsers assemble the final Windows executable from various components, rather than downloading a complete malicious file from a single URL. This operation has been active since late 2024 and primarily targets retail traders and cryptocurrency investors, impersonating platforms such as TradingView, Solana, and Luno.
Mechanics of the Attack
According to a report by Confiant published on July 23, 2026, the campaign operates across 12 countries and in 25 languages. It utilizes landing pages that fingerprint visitors, displaying an empty page to suspected researchers and bots while providing a convincing interface to selected targets. The method does not exploit any browser vulnerabilities nor does it remove the Mark of the Web (MotW), which typically indicates the source of downloaded files.
File Assembly Process
The delivery mechanism begins by registering a ServiceWorker at /sw.js, which then builds a SharedWorker using JavaScript embedded in the page. This SharedWorker requests a configuration file from a secondary domain, which includes a template and session-specific values. The browser retrieves a clean Bun runtime from the domain purelogicbox[.]org, which is then used to assemble the malicious executable.
The final executable is constructed using a combination of the Bun runtime, a pseudorandom byte stream generated with AES in counter mode, and attacker-controlled content. Each victim may receive a uniquely assembled file, as variations in the configuration response can alter the hash while maintaining the malicious payload.
Implications and Recommendations
Michael Steele from Confiant noted, “No finished malware ever exists on the network,” indicating that the complete malicious file is never fully formed until it reaches the victim’s browser. This poses challenges for traditional detection methods, as unique per-session builds complicate hash-based detection strategies. Confiant emphasizes the importance of examining the entire chain of delivery, from the initial ad referral to the final download process.
While there is no software patch available to mitigate this threat, users are advised to install trading and wallet software directly from official vendor sites rather than through advertisements. Confiant has also published three SHA-256 hashes and a list of 96 malicious domains associated with this campaign.
Uncertainties and Further Investigation
Although there are connections to previous malvertising activities documented by Bitdefender, including payloads identified as JSCEAL and WeevilProxy, it remains unconfirmed whether the current samples carry these specific threats. The Hacker News has reached out to Confiant for further clarification regarding these associations and will provide updates as more information becomes available.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
