SourTrade Malvertising: ServiceWorker-Orchestrated In-Browser Assembly Builds a Unique Windows Executable Per Victim — Threadlinqs Intelligence
As of 2026-07-25, SourTrade Malvertising: ServiceWorker-Orchestrated In-Browser Assembly Builds a Unique Windows Executable Per Victim is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1696 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
The 'SourTrade' malvertising operation, active since late 2024, impersonates TradingView, Solana, and Luno across malicious Google Ads, Meta, and Twitter/X ad placements to target retail traders and
SourTrade is a long-running malvertising campaign, first observed operating in late 2024 and still active as of the July 2026 Confiant disclosure, that lures retail traders and cryptocurrency investors by impersonating TradingView, Solana, and Luno in sponsored advertisements distributed through Google Ads, Meta/Facebook, and Twitter/X ad ecosystems across 12 countries (reported targeting spans Japan, Thailand, South Korea, Taiwan, Hong Kong, Australia, Bolivia, Brazil, Nigeria, South Africa, Türkiye, and Great Britain) in 25 languages.
Landing pages implement a visitor-fingerprinting/cloaking layer that serves a blank, harmless page to suspected researchers, bots, and automated scanners while routing selected targets to convincing brand-impersonation pages. Rather than distributing a finished executable, the campaign moves malware construction into the victim's own browser: a page-scoped ServiceWorker (registered at `/sw.js`, with source embedded inline to avoid a separate network fetch) intercepts same-origin requests and manages a streamed download; a SharedWorker built from an embedded JavaScript blob (so it is never fetched from a visible URL) requests a `/config` endpoint. That endpoint returns a JSON assembly profile containing a byte-copy 'template' array, a `standaloneUrl` pointing to a clean Bun JavaScript runtime binary, and a per-session AES-CTR seed and size. The worker generates a large pseudorandom byte stream via AES in counter mode, then follows the template to interleave ranges of the clean Bun runtime, the generated pseudorandom stream, and attacker-supplied Base64-encoded blobs (the PE header, section table, and a `.bun` section carrying malicious JavaScriptCore bytecode) into a complete Windows Portable Executable. Because the AES-CTR seed and size are unique per victim/session, no two assembled files share a hash, even though the embedded malicious logic is constant — 'no finished malware ever exists on the network.' The finished stream is handed to the ServiceWorker, which serves it as a same-origin download (via a hidden iframe navigation and a `Content-Disposition: attachment` response header), so the resulting file's Mark-of-the-Web record attributes it to the landing-page origin rather than to the true component sources (the Bun-runtime host and the attacker's config endpoint). Multiple independent write-ups (Confiant, GBHackers, Cybersecurity News, Cyberpress) corroborate a secondary infrastructure domain, `purelogicbox.org`, used to host the clean Bun 'standalone' runtime fetched during assembly; a BeaconBeagle configuration-search lookup against this domain returned no existing C2 correlation records at time of research. Confiant's disclosure additionally identifies approximately 96 malicious domains associated with the campaign to date, alongside three referenced-but-unpublished SHA-256 samples; multiple secondary outlets (Cybersecurity News, Cryptika) present what they describe as SHA-256 IOC tables for these samples, but cross-checking their published hash strings against an independent re-fetch of the same pages produced mutually inconsistent digit sequences (leading/trailing-digit drift consistent with a table-scraping artifact), so no specific hash value is reproduced in this record pending an authoritative, internally-consistent publication.
The delivery mechanism itself evolved: campaign variants observed through April 30, 2026 relied on a GitHub Pages-hosted copy of the StreamSaver.js library to manipulate Mark-of-the-Web attribution; the current ServiceWorker/SharedWorker/Bun-assembly technique documented by Confiant on July 23, 2026 supersedes that approach and represents an operational evolution toward a harder-to-detect, fully in-browser build pipeline. The Hacker News reported on Confiant's findings on July 25, 2026, and independent outlets GBHackers, Cybersecurity News, Cyberpress, and Cryptika published their own technical analyses within roughly a day of the original disclosure.
Target sectors: finance, cryptocurrency
Target regions: Asia-Pacific, Latin America, Africa, Oceania, Europe
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1584, T1586, T1608, T1587, T1189, T1204, T1204, T1059, T1027, T1140