# SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection

> SourTrade is a malvertising cluster active since late 2024 that impersonates TradingView, Solana, and Luno across 25 languages in 12 countries to drive retail traders and crypto investors to landing pages that build a malicious Windows executable directly in browser memory using a ServiceWorker/SharedWorker chain, a clean Bun runtime, and per-session AES-CTR-derived bytes, rather than serving a finished file. The resulting payload can intercept network traffic, steal cookies/passwords and cryptocurrency wallet data, log keystrokes, capture screenshots, and establish persistence. Confiant disclosed the current technique on 2026-07-23; the campaign previously delivered via the StreamSaver.js library through 2026-04-30 before pivoting to this ServiceWorker/SharedWorker chain.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1687
- **ID:** TL-2026-1687
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SourTrade is a long-running malvertising operation, first tracked by Confiant as active since late 2024, that abuses Google Ads, Meta/Facebook Ads, and X/Twitter Ads to place sponsored links to convincing clones of TradingView, Solana, and Luno. Confiant's disclosure documents attribution indicators tying the ad creatives together across networks: shared Google Ads conversion-tracking logic, Meta/Facebook pixel calls, and Twitter/X pixel loading embedded in the same landing-page templates. Visitor traffic is fingerprinted and cloaked: suspected researchers, bots, and automated scanners are served blank/white pages, while filtered real targets (retail traders and cryptocurrency investors) receive the fake trading-platform page and its malicious JavaScript. Confiant's disclosure catalogs a sprawling infrastructure of 120+ malicious SourTrade domains spanning .digital, .club, .info, .site, and .com TLDs, of which the domains below are a representative, individually-confirmed sample.

The defining innovation, documented by Confiant on 2026-07-23 and corroborated by GBHackers, Cyber Security News, and CyberPress the following day, is that SourTrade never transmits a finished malicious binary over the network. Instead the landing page's JavaScript registers a ServiceWorker (/sw.js) that acts as a download manager, and instantiates a SharedWorker from an embedded JS blob that maintains an in-memory download-stream map with ~25-second keep-alive pings. The SharedWorker requests a `/config` endpoint that returns, per victim session, a random `seed`/`size` pair, a byte-copy "template" array (a mix of literal base64 blobs and `[source_id, offset, length]` range specifications), and a `standaloneUrl` pointing to a clean, gunzipped Bun JavaScript-runtime executable hosted on separate attacker infrastructure (observed: purelogicbox[.]org). In the browser, the client combines three inputs — the clean Bun runtime, locally generated AES-CTR pseudorandom bytes seeded from the server value, and base64-encoded C2-delivered blobs containing a PE header, section table, and a malicious `.bun` section holding JavaScriptCore bytecode — and executes the template's byte-copy recipe to assemble a unique Windows PE in memory. Because the AES-CTR seed and size rotate per victim/session, every assembled executable has a different file hash, defeating static hash-based and network-signature detection by design. The completed stream is handed back to the ServiceWorker, which serves it as a same-origin download via a hidden-iframe navigation, so the browser's Mark-of-the-Web attribution records the trusted landing-page origin rather than the true cross-origin component sources.

Per the source reporting relied on for this threat's hunt trigger (BleepingComputer, 2026-07-25) and corroborating technical write-ups, the assembled payload is capable of intercepting/proxying network traffic, stealing browser cookies and stored passwords, exfiltrating cryptocurrency wallet data, keylogging, capturing screenshots, and establishing persistence; exact on-disk persistence mechanics were not disclosed in the available reporting. GBHackers additionally notes a possible relationship between SourTrade's payload family and the JSCEAL/WeevilProxy stealer — a multi-stage loader chain, first documented by Check Point Research on 2025-07-01 and tracked separately by WithSecure, that has delivered stealer payloads across Windows, macOS, and Android since at least 2025 via a related fake-crypto-app Facebook Ads ecosystem. This linkage is reported by a single secondary source and is not confirmed by the primary Confiant research, so it is treated here as a low-confidence, sourced-but-unverified lead rather than established fact.

SourTrade's current ServiceWorker/SharedWorker delivery chain is itself an evolution: the campaign relied on the StreamSaver.js GitHub library to force browser downloads through 2026-04-30 (the same delivery method Bitdefender documented on 2025-09-25 in a report on 'TradingView Premium' malvertising expanding from Meta to Google/YouTube ad networks) before switching to the current in-memory PE-assembly technique. No CVE, CVSS score, or exploited vulnerability is associated with this threat — the technique abuses standard, legitimate Web Platform APIs (ServiceWorker, SharedWorker) rather than a software flaw.

## MITRE ATT&CK

- T1592.002 Software
- T1583.001 Domains
- T1583.008 Malvertising
- T1608.001 Upload Malware
- T1585.001 Social Media Accounts
- T1588.002 Tool
- T1189 Drive-by Compromise
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1132.001 Standard Encoding
- T1113 Screen Capture
- T1056.001 Keylogging
- T1005 Data from Local System
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers

## Sources

- [Malicious sites use JavaScript to build malware in browser memory](https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/)
- [SourTrade: Browser-Assembled Malware Delivered Through Malvertising](https://blog.confiant.com/p/sourtrade-browser-assembled-malware)
- [SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design](https://gbhackers.com/sourtrade-browser-assembled/)
- [SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection](https://cybersecuritynews.com/sourtrade-malvertising-malware/)
- [Hackers Abuse Service Workers to Assemble Malware Inside Web Browsers](https://cyberpress.org/service-worker-malware-assembly/)
- [SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection](https://www.cryptika.com/sourtrade-malvertising-builds-unique-malware-inside-victims-browsers-to-evade-detection/)
- [The Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube](https://www.bitdefender.com/en-au/blog/labs/the-scam-that-wont-quit-malicious-tradingview-premium-ads-jump-from-meta-to-google-and-youtube)
- [Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal](https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1687