A malvertising campaign aimed at crypto investors and retail traders is using fake TradingView, Solana, and Luno pages to make the victim’s own browser assemble malware in memory, according to new research from ad-security firm Confiant.
The campaign, which Confiant tracks as SourTrade, has been active since late 2024 and targets users across 12 countries in 25 languages. Confiant’s July 23 analysis says the fake pages use cloaking to separate likely victims from researchers and scanning systems: analysts may see a harmless blank page, while a target sees a convincing trading or cryptocurrency download page.
BleepingComputer reported on July 25 that the operation is localized mainly for Asia-Pacific and Latin American audiences, with fake Solana, Luno, and TradingView portals used as the lure. The important detail is not simply that criminals are abusing trusted financial brands. It is that the malicious site does not hand the browser one finished malware file to download.
How the browser becomes the build system
On SourTrade’s so-called money pages, the browser is turned into a local malware assembly pipeline. Confiant found that the landing page registers a service worker for streamed file delivery and starts a shared worker from JavaScript embedded in the page. That shared worker asks the same site for a /config response, but the response is not a normal executable download.
Instead, the configuration response includes build instructions: a template, a URL for a clean Bun runtime, and per-session random values. The browser fetches the clean runtime, combines it with delivered blobs and locally generated AES-CTR bytes, then produces the final Windows executable inside the victim’s browser session. Once the file is assembled, the service worker delivers it back to the browser through a same-origin download path.
That same-origin step matters. From the browser’s point of view, the final attachment appears to come from the fake landing-page domain. Confiant says earlier SourTrade variants used the StreamSaver project for delivery, but the post-April 2026 flow shifted toward the same-origin service-worker method.
Why this makes detection harder
The campaign is designed to reduce the usefulness of static hashes. If every victim can receive a slightly different assembled file, then a single known-bad hash becomes a weaker indicator. A network tool may also see apparently separate pieces: a landing page, a clean runtime, JavaScript, configuration data, and a browser-managed download. Reviewing any one component by itself can miss the attack chain.
That does not make the campaign invisible. It shifts the useful evidence toward behavior: suspicious sponsored-download paths, service-worker registration on fake trading pages, unusual /config responses, hidden iframe-triggered downloads, unexpected Bun-based executables, and endpoint alerts that show browser-driven file creation followed by execution.
The technique is especially risky for crypto users because attackers are already using trading-tool lures to install credential and wallet-stealing malware. In April, Malwarebytes described a fake TradingClaw site that impersonated an AI trading assistant for TradingView and delivered Needle Stealer, a modular infostealer capable of targeting browser data, login sessions, wallet information, and malicious browser extensions.
What users should change
For individual traders and crypto users, the simplest rule is still the strongest one: do not install wallet, exchange, charting, or trading software from sponsored search results, social ads, or promoted posts. Use the official site you have typed or bookmarked yourself, and verify that a tool is actually listed by the platform it claims to support.
Crypto users should also keep wallets separate by risk. A hot wallet used to test new services should not hold the same assets as long-term storage. Solana’s own security guide gives the same broad advice: verify websites, be cautious with new apps, avoid entering seed phrases, and move funds quickly from a clean device if a wallet may be compromised.
There are several specific warning signs in this campaign family. Be wary of a trading page that arrives from an ad rather than the official brand domain, asks for a desktop download when the product is normally web-based, promotes a too-good-to-be-true AI trading assistant, or produces a Windows executable from a page that should only be offering account access or documentation.
What security teams should watch
For security teams, SourTrade is a reminder that download reputation should not depend only on final-file hashes. Controls should account for the full browser chain: ad click, redirect, landing-page behavior, worker registration, configuration requests, file stream creation, and process execution after download.
Practical steps include blocking newly registered or suspicious lookalike domains, monitoring for known SourTrade indicators from Confiant’s report, restricting execution from user download folders where possible, and investigating browser-originated executable downloads that are followed by credential-store access, wallet-app access, browser-extension changes, or persistence activity.
Organizations with employees who trade crypto from work devices have an extra policy problem. Even when the company is not the intended target, an infostealer installed through a fake trading app can expose enterprise browser sessions, cloud tokens, password managers, Slack or Microsoft 365 access, and developer credentials. That makes this a workplace security issue, not only a personal-finance scam.
The broader lesson is that browsers are now powerful enough to participate in complex malware delivery, not just display a deceptive page. SourTrade abuses ordinary web capabilities, including service workers and shared workers, to make the final file harder to see in transit. The defense has to follow the same path end to end.
