SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection — Threadlinqs Intelligence
As of 2026-07-25, SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1687 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
SourTrade is a malvertising cluster active since late 2024 that impersonates TradingView, Solana, and Luno across 25 languages in 12 countries to drive retail traders and crypto investors to landing
SourTrade is a long-running malvertising operation, first tracked by Confiant as active since late 2024, that abuses Google Ads, Meta/Facebook Ads, and X/Twitter Ads to place sponsored links to convincing clones of TradingView, Solana, and Luno. Confiant's disclosure documents attribution indicators tying the ad creatives together across networks: shared Google Ads conversion-tracking logic, Meta/Facebook pixel calls, and Twitter/X pixel loading embedded in the same landing-page templates. Visitor traffic is fingerprinted and cloaked: suspected researchers, bots, and automated scanners are served blank/white pages, while filtered real targets (retail traders and cryptocurrency investors) receive the fake trading-platform page and its malicious JavaScript. Confiant's disclosure catalogs a sprawling infrastructure of 120+ malicious SourTrade domains spanning .digital, .club, .info, .site, and .com TLDs, of which the domains below are a representative, individually-confirmed sample.
The defining innovation, documented by Confiant on 2026-07-23 and corroborated by GBHackers, Cyber Security News, and CyberPress the following day, is that SourTrade never transmits a finished malicious binary over the network. Instead the landing page's JavaScript registers a ServiceWorker (/sw.js) that acts as a download manager, and instantiates a SharedWorker from an embedded JS blob that maintains an in-memory download-stream map with ~25-second keep-alive pings. The SharedWorker requests a `/config` endpoint that returns, per victim session, a random `seed`/`size` pair, a byte-copy "template" array (a mix of literal base64 blobs and `[source_id, offset, length]` range specifications), and a `standaloneUrl` pointing to a clean, gunzipped Bun JavaScript-runtime executable hosted on separate attacker infrastructure (observed: purelogicbox[.]org). In the browser, the client combines three inputs — the clean Bun runtime, locally generated AES-CTR pseudorandom bytes seeded from the server value, and base64-encoded C2-delivered blobs containing a PE header, section table, and a malicious `.bun` section holding JavaScriptCore bytecode — and executes the template's byte-copy recipe to assemble a unique Windows PE in memory. Because the AES-CTR seed and size rotate per victim/session, every assembled executable has a different file hash, defeating static hash-based and network-signature detection by design. The completed stream is handed back to the ServiceWorker, which serves it as a same-origin download via a hidden-iframe navigation, so the browser's Mark-of-the-Web attribution records the trusted landing-page origin rather than the true cross-origin component sources.
Per the source reporting relied on for this threat's hunt trigger (BleepingComputer, 2026-07-25) and corroborating technical write-ups, the assembled payload is capable of intercepting/proxying network traffic, stealing browser cookies and stored passwords, exfiltrating cryptocurrency wallet data, keylogging, capturing screenshots, and establishing persistence; exact on-disk persistence mechanics were not disclosed in the available reporting. GBHackers additionally notes a possible relationship between SourTrade's payload family and the JSCEAL/WeevilProxy stealer — a multi-stage loader chain, first documented by Check Point Research on 2025-07-01 and tracked separately by WithSecure, that has delivered stealer payloads across Windows, macOS, and Android since at least 2025 via a related fake-crypto-app Facebook Ads ecosystem. This linkage is reported by a single secondary source and is not confirmed by the primary Confiant research, so it is treated here as a low-confidence, sourced-but-unverified lead rather than established fact.
SourTrade's current ServiceWorker/SharedWorker delivery chain is itself an evolution: the campaign relied on the StreamSaver.js GitHub library to force browser downloads through 2026-04-30 (the same delivery method Bitdefender documented on 2025-09-25 in a
Target sectors: financial services, cryptocurrency, retail investors
Target regions: Asia-Pacific, Latin America, Africa, Europe, Oceania
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1592.002, T1583.001, T1583.008, T1608.001, T1585.001, T1588.002, T1189, T1059.007, T1204.002, T1027
