Threat reportMalwareTL-2026-1687
SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection
SourTrade Malvertising Campaign Assembles Windows Malware (TL-2026-1687), also tracked as SourTrade, is a high-severity malware campaign, first published 2026-07-25. It has no confirmed attribution, affects Various (Chromium, Firefox, WebKit) Web browsers implementing the, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1687
- Threat ID
- TL-2026-1687
- Also known as
- SourTrade
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, cryptocurrency, retail investors
- Target regions
- Asia-Pacific, Latin America, Africa, Europe, Oceania
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in SourTrade Malvertising Campaign Assembles Windows Malware
Malware and tooling: JSCEAL/WeevilProxy, Bun, StreamSaver.js
How SourTrade Malvertising Campaign Assembles Windows Malware works
SourTrade is a malvertising cluster active since late 2024 that impersonates TradingView, Solana, and Luno across 25 languages in 12 countries to drive retail traders and crypto investors to landing pages that build a malicious Windows executable directly in browser memory using a ServiceWorker/SharedWorker chain, a clean Bun runtime, and per-session AES-CTR-derived bytes, rather than serving a finished file. The resulting payload can intercept network traffic, steal cookies/passwords and cryptocurrency wallet data, log keystrokes, capture screenshots, and establish persistence. Confiant disclosed the current technique on 2026-07-23; the campaign previously delivered via the StreamSaver.js library through 2026-04-30 before pivoting to this ServiceWorker/SharedWorker chain.
SourTrade is a long-running malvertising operation, first tracked by Confiant as active since late 2024, that abuses Google Ads, Meta/Facebook Ads, and X/Twitter Ads to place sponsored links to convincing clones of TradingView, Solana, and Luno. Confiant's disclosure documents attribution indicators tying the ad creatives together across networks: shared Google Ads conversion-tracking logic, Meta/Facebook pixel calls, and Twitter/X pixel loading embedded in the same landing-page templates. Visitor traffic is fingerprinted and cloaked: suspected researchers, bots, and automated scanners are served blank/white pages, while filtered real targets (retail traders and cryptocurrency investors) receive the fake trading-platform page and its malicious JavaScript. Confiant's disclosure catalogs a sprawling infrastructure of 120+ malicious SourTrade domains spanning .digital, .club, .info, .site, and .com TLDs, of which the domains below are a representative, individually-confirmed sample.
The defining innovation, documented by Confiant on 2026-07-23 and corroborated by GBHackers, Cyber Security News, and CyberPress the following day, is that SourTrade never transmits a finished malicious binary over the network. Instead the landing page's JavaScript registers a ServiceWorker (/sw.js) that acts as a download manager, and instantiates a SharedWorker from an embedded JS blob that maintains an in-memory download-stream map with ~25-second keep-alive pings. The SharedWorker requests a `/config` endpoint that returns, per victim session, a random `seed`/`size` pair, a byte-copy "template" array (a mix of literal base64 blobs and `[source_id, offset, length]` range specifications), and a `standaloneUrl` pointing to a clean, gunzipped Bun JavaScript-runtime executable hosted on separate attacker infrastructure (observed: purelogicbox[.]org). In the browser, the client combines three inputs — the clean Bun runtime, locally generated AES-CTR pseudorandom bytes seeded from the server value, and base64-encoded C2-delivered blobs containing a PE header, section table, and a malicious `.bun` section holding JavaScriptCore bytecode — and executes the template's byte-copy recipe to assemble a unique Windows PE in memory. Because the AES-CTR seed and size rotate per victim/session, every assembled executable has a different file hash, defeating static hash-based and network-signature detection by design. The completed stream is handed back to the ServiceWorker, which serves it as a same-origin download via a hidden-iframe navigation, so the browser's Mark-of-the-Web attribution records the trusted landing-page origin rather than the true cross-origin component sources.
Per the source reporting relied on for this threat's hunt trigger (BleepingComputer, 2026-07-25) and corroborating technical write-ups, the assembled payload is capable of intercepting/proxying network traffic, stealing browser cookies and stored passwords, exfiltrating cryptocurrency wallet data, keylogging, capturing screenshots, and establishing persistence; exact on-disk persistence mechanics were not disclosed in the available reporting. GBHackers additionally notes a possible relationship between SourTrade's payload family and the JSCEAL/WeevilProxy stealer — a multi-stage loader chain, first documented by Check Point Research on 2025-07-01 and tracked separately by WithSecure, that has delivered stealer payloads across Windows, macOS, and Android since at least 2025 via a related fake-crypto-app Facebook Ads ecosystem. This linkage is reported by a single secondary source and is not confirmed by the primary Confiant research, so it is treated here as a low-confidence, sourced-but-unverified lead rather than established fact.
SourTrade's current ServiceWorker/SharedWorker delivery chain is itself an evolution: the campaign relied on the StreamSaver.js GitHub library to force browser downloads through 2026-04-30 (the same delivery method Bitdefender documented on 2025-09-25 in a report on 'TradingView Premium' malvertising expanding from Meta to Google/YouTube ad networks) before switching to the current in-memory PE-assembly technique. No CVE, CVSS score, or exploited vulnerability is associated with this threat — the technique abuses standard, legitimate Web Platform APIs (ServiceWorker, SharedWorker) rather than a software flaw.
MITRE ATT&CK techniques used in TL-2026-1687
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
Initial Access
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1585.001 Social Media Accounts; T1588.002 Tool; T1608.001 Upload Malware
Reconnaissance
Affected products and versions in SourTrade Malvertising Campaign Assembles Windows Malware
- Various (Chromium, Firefox, WebKit) — Web browsers implementing the ServiceWorker and SharedWorker Web APIs
Vulnerable versions: Any browser version supporting ServiceWorker + SharedWorker (technique abuses standard, legitimate Web Platform APIs, not a software defect)
Fixed in: N/A — no vendor patch applicable; mitigation is network/behavioral detection, not a browser update - Bun (Oven, Inc.) — Bun JavaScript runtime executable
Vulnerable versions: A clean/unmodified Bun standalone executable is repurposed as a payload-construction component; Bun itself is not vulnerable
Fixed in: N/A
Remediation for SourTrade Malvertising Campaign Assembles Windows Malware
Immediate actions
- Block the identified SourTrade landing-page domains and purelogicbox[.]org at web proxy/DNS layer
- Alert on unsigned/newly-created Windows executables that were delivered via a browser ServiceWorker-controlled same-origin download (hidden-iframe navigation to a locally-served attachment) rather than a direct network download
- Hunt for ServiceWorker registrations requesting a '/config' endpoint that returns randomized seed/size parameters and base64 template arrays on ad-referred domains impersonating trading/crypto brands
- Block or heavily scrutinize ad-referred downloads of any executable bearing an embedded Bun runtime / JavaScriptCore '.bun' section
- Advise retail-trader and crypto-investor user populations to avoid downloading 'trading platform' software from sponsored/ad search results and to obtain apps only from official vendor sites/app stores
Workarounds
- Enterprise browser policy: restrict or monitor ServiceWorker/SharedWorker registration on non-allowlisted origins where feasible
- Web/DNS filtering categorization of newly-registered lookalike financial/crypto domains
Longer-term hardening
- Deploy browser-side or EDR telemetry that can flag anomalous ServiceWorker/SharedWorker registrations performing multi-source byte assembly and in-memory PE construction
- Work with ad-network abuse teams (Google Ads, Meta, X) to report and take down malvertising accounts tied to identified SourTrade domain clusters
- Deploy behavioral/EDR detection for post-execution indicators (credential-store access, screenshot APIs, keyboard hooking, wallet-file access, outbound proxying) since static/hash-based detection is defeated by design
- Track and correlate rotating SourTrade infrastructure (new TLD/registrar patterns) for early landing-page takedown
Timeline of SourTrade Malvertising Campaign Assembles Windows Malware
- SourTrade malvertising campaign becomes active, impersonating trading/crypto platforms via sponsored ads (exact date not disclosed by sources; reported as 'late 2024').
- Per GBHackers' reporting on the Confiant disclosure, Bitdefender's separate investigation of the related TradingView Premium/JSCEAL ecosystem traces multi-stage loader-chain activity delivering JSCEAL/WeevilProxy stealer payloads across Windows, macOS, and Android back to 'at least 2025' (exact month not disclosed).
- Check Point Research publishes 'Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal,' the primary documentation of the JSCEAL/WeevilProxy stealer family later floated (low-confidence) as possibly related to SourTrade's payload.
- Bitdefender publishes 'The Scam That Won't Quit,' documenting a related 'TradingView Premium' malvertising campaign using the StreamSaver.js browser-download-forcing library and its expansion from Meta/Facebook Ads to Google and YouTube ad networks — the delivery method SourTrade used prior to its 2026-04-30 pivot.
- SourTrade's StreamSaver.js/GitHub-hosted-helper delivery variant remains active through this date; operators subsequently abandon it and switch to the current ServiceWorker/SharedWorker in-browser malware-assembly chain, eliminating the GitHub dependency (Confiant).
- Confiant publishes 'SourTrade: Browser-Assembled Malware Delivered Through Malvertising,' the primary technical disclosure of the four-stage ServiceWorker/SharedWorker/Bun/AES-CTR assembly pipeline and a catalog of 120+ malicious SourTrade domains.
- GBHackers, Cyber Security News, CyberPress, and Cryptika publish independent technical write-ups of the Confiant research, including malicious domain lists.
- Campaign confirmed still operating at time of hunt, targeting Solana, Luno, and TradingView users across 12 countries (Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Turkey, South Africa, Australia, Great Britain) and 25 languages, primarily APAC and LatAm.
- BleepingComputer publishes coverage of the campaign ('Malicious sites use JavaScript to build malware in browser memory'), the source article that triggered this TL-Intel hunt.
Sources cited for SourTrade Malvertising Campaign Assembles Windows Malware
- Malicious sites use JavaScript to build malware in browser memory
- SourTrade: Browser-Assembled Malware Delivered Through Malvertising
- SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design
- SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection
- Hackers Abuse Service Workers to Assemble Malware Inside Web Browsers
- SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection
- The Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube
- Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal
Detection coverage for TL-2026-1687
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1687 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.