SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design

SourTrade turns the browser itself into a malware build system, deliberately sidestepping the industry’s reliance on hash-based file fingerprints and traditional network-centric detection.

SourTrade has been active since late 2024, abusing programmatic ads to reach retail traders and crypto investors in 12 geographies across APAC, LATAM, Africa, and Western markets, including Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Türkiye, South Africa, Australia, and Great Britain.

Landing pages deploy a cloaking kit that fingerprints visitors and cleanly separates analysts, bots, and automated scanners from human victims.

Researchers and non-target traffic are served a benign white page, while valid victims see convincing replicas of trusted trading and crypto platforms.

Telemetry embedded in these pages exposes tracking logic for Google Ads, Meta/Facebook pixels, and Twitter/X beacons, aligning SourTrade with the malvertising cluster previously documented by Bitdefender in its TradingView Premium campaign across Meta, Google, and YouTube.

Technically, SourTrade’s defining feature is that its landing pages never serve a finished malware binary from a static URL.

Instead, they ship assembly instructions to the browser, fetch a clean Bun “standalone” runtime from separate infrastructure, and instruct the browser to assemble a unique Windows executable in memory using a template, C2-delivered blobs, and locally generated AES‑CTR bytes.

Stage 1 registers a ServiceWorker (/sw.js) and a SharedWorker constructed from in-page JavaScript text, establishing a streamed delivery path tied to the landing page origin.

Stage 2 issues an internal /config request that returns a JSON assembly profile: a session-specific random seed and size, a template array describing byte-copy operations, and a standaloneUrl pointing to a clean Bun runtime hosted on a secondary domain such as purelogicbox[.]org.

Stage 3 fetches and decompresses the Bun runtime, generates a per-victim AES‑CTR byte stream from the supplied seed and size, and feeds both plus base64-encoded PE header, section table, and .bun section blobs into a template-driven assembler.

The template acts as a byte-copy recipe, walking source ranges, stitching together the clean interpreter, actor-controlled PE structures, and pseudorandom padding to produce a one-off executable whose hash is effectively unique for every victim.

Stage 4 hands the assembled ReadableStream to the ServiceWorker, derives a same-origin download URL, and triggers a hidden-iframe navigation.

Hence, the browser treats the payload as a normal attachment from the landing page’s domain. The resulting Mark of the Web (MotW) signature records a same-origin path, obscuring the fact that key components originated from external infrastructure that never appear directly in network logs.

Because SourTrade never exposes a stable malicious binary over the wire, traditional fingerprinting approaches are structurally blind to its payloads.

Confiant said in a report shared with GBhackers, SourTrade operators impersonate TradingView, Solana, and Luno, presenting localized creatives in English and the target GEO’s language to blend into legitimate financial advertising ecosystems.

Security tools and network inspection stacks see a clean Bun runtime download, session-specific AES‑CTR output that looks like random data, and a JavaScript-controlled assembly process, not a single known malicious file.

SourTrade Browser-Assembled

Each victim’s executable is diversified via the rotated AES‑CTR seed and size, plus the flexible template array, ensuring that every build yields a different hash and PE layout while preserving the same .bun section containing malicious JavaScriptCore bytecode.

The browser-side assembly model mirrors the evasion strategies highlighted in Bitdefender’s earlier TradingView Premium reporting, where the same cluster abused StreamSaver.js hosted on GitHub to manipulate MotW paths and deliver oversized, sandbox-resistant downloaders.

Crucially, any single artifact a clean Bun executable retrieved via standaloneUrl, an innocuous-looking /config response, or a same-origin download entry in logs appears benign when viewed in isolation.

Only end-to-end analysis of the full chain from cloaked landing page and fingerprinting, through /config assembly instructions, to ServiceWorker-mediated stream delivery and MotW manipulation reveals SourTrade’s true behavior.

IOC data tied to SourTrade shows a sprawling infrastructure of rotating domains and subdomains designed to support high-volume ad operations and flexible delivery paths.

Bitdefender’s work on the related TradingView Premium malvertising campaigns identified hundreds of domains, hijacked Google and Meta business accounts.

A multi-stage loader chain that ultimately delivered JSCEAL/WeevilProxy stealer payloads across Windows, macOS, and Android, confirming that this ecosystem has been active and expanding since at least 2025.

Recent landing page artifacts and Bun-standalone characteristics indicate that SourTrade continues to refine its browser-side assembly technique through 2026, moving from StreamSaver.js-based MotW tricks to fully origin-scoped ServiceWorker delivery with local assembly in memory.

Taken together, the evolving delivery path, cross-platform payloads, and persistent brand impersonations position SourTrade as a durable malvertising threat cluster engineered to defeat hash-based detection, frustrate sandbox analysis, and weaponize the browser as an assembly line for bespoke malware.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist