SourTrade is a long-running malvertising campaign, first observed operating in late 2024 and still active as of the July 2026 Confiant disclosure, that lures retail traders and cryptocurrency investors by impersonating TradingView, Solana, and Luno in sponsored advertisements distributed through Google Ads, Meta/Facebook, and Twitter/X ad ecosystems across 12 countries (reported targeting spans Japan, Thailand, South Korea, Taiwan, Hong Kong, Australia, Bolivia, Brazil, Nigeria, South Africa, Türkiye, and Great Britain) in 25 languages.

Landing pages implement a visitor-fingerprinting/cloaking layer that serves a blank, harmless page to suspected researchers, bots, and automated scanners while routing selected targets to convincing brand-impersonation pages. Rather than distributing a finished executable, the campaign moves malware construction into the victim's own browser: a page-scoped ServiceWorker (registered at `/sw.js`, with source embedded inline to avoid a separate network fetch) intercepts same-origin requests and manages a streamed download; a SharedWorker built from an embedded JavaScript blob (so it is never fetched from a visible URL) requests a `/config` endpoint. That endpoint returns a JSON assembly profile containing a byte-copy 'template' array, a `standaloneUrl` pointing to a clean Bun JavaScript runtime binary, and a per-session AES-CTR seed and size. The worker generates a large pseudorandom byte stream via AES in counter mode, then follows the template to interleave ranges of the clean Bun runtime, the generated pseudorandom stream, and attacker-supplied Base64-encoded blobs (the PE header, section table, and a `.bun` section carrying malicious JavaScriptCore bytecode) into a complete Windows Portable Executable. Because the AES-CTR seed and size are unique per victim/session, no two assembled files share a hash, even though the embedded malicious logic is constant — 'no finished malware ever exists on the network.' The finished stream is handed to the ServiceWorker, which serves it as a same-origin download (via a hidden iframe navigation and a `Content-Disposition: attachment` response header), so the resulting file's Mark-of-the-Web record attributes it to the landing-page origin rather than to the true component sources (the Bun-runtime host and the attacker's config endpoint). Multiple independent write-ups (Confiant, GBHackers, Cybersecurity News, Cyberpress) corroborate a secondary infrastructure domain, `purelogicbox.org`, used to host the clean Bun 'standalone' runtime fetched during assembly; a BeaconBeagle configuration-search lookup against this domain returned no existing C2 correlation records at time of research. Confiant's disclosure additionally identifies approximately 96 malicious domains associated with the campaign to date, alongside three referenced-but-unpublished SHA-256 samples; multiple secondary outlets (Cybersecurity News, Cryptika) present what they describe as SHA-256 IOC tables for these samples, but cross-checking their published hash strings against an independent re-fetch of the same pages produced mutually inconsistent digit sequences (leading/trailing-digit drift consistent with a table-scraping artifact), so no specific hash value is reproduced in this record pending an authoritative, internally-consistent publication.

The delivery mechanism itself evolved: campaign variants observed through April 30, 2026 relied on a GitHub Pages-hosted copy of the StreamSaver.js library to manipulate Mark-of-the-Web attribution; the current ServiceWorker/SharedWorker/Bun-assembly technique documented by Confiant on July 23, 2026 supersedes that approach and represents an operational evolution toward a harder-to-detect, fully in-browser build pipeline. The Hacker News reported on Confiant's findings on July 25, 2026, and independent outlets GBHackers, Cybersecurity News, Cyberpress, and Cryptika published their own technical analyses within roughly a day of the original disclosure.

Attribution and final-payload capability remain explicitly unconfirmed for the current SourTrade samples. Confiant's public disclosure references three unpublished SHA-256 samples and does not disclose specific IOC values for the current wave, and does not assert a malware-family attribution. A separate, well-documented Bitdefender campaign — 'The Scam That Won't Quit: Malicious TradingView Premium Ads Jump from Meta to Google and YouTube' (published September 27, 2025, independently corroborated by Cybersecurity Asia, iTWire, SC World, and KBI Media) — tracked a related TradingView-impersonation malvertising cluster whose final payload was identified as JSCEAL (Check Point's name) / WeevilProxy (WithSecure's name) / Trojan.Agent.GOSL (Bitdefender's final-payload detection name), an infostealer/RAT hybrid capable of full network traffic interception (acting as a local proxy), keylogging, screenshot capture, and cookie/password/cryptocurrency-wallet theft, distributed via an initial loader Bitdefender detects as Variant.DenoSnoop.Marte.1 persisting through a Windows Scheduled Task named `EdgeResourcesInstallerV12-issg`, with macOS (Variant.MAC.Amos.9) and Android (Android.Trojan.Dropper.AVV, Android.Trojan.Banker.AVM) variants also observed, using an oversized (700MB+) downloader for anti-sandbox evasion, and a shift from plaintext HTTP C2 on ports 30303/30308 (routes `/s`, `/set`, `/q`, `/query`) to WebSocket C2 on port 30000 with a `/config` route. Bitdefender's monitoring of this related cluster covered 'the past year' as of its September 2025 publication (placing its earliest tracked activity around September 2024) and identified over 500 rotating domains and subdomains supporting the operation, plus third-party analytics/ad-tracking abuse (PostHog, Facebook Pixel, Microsoft Ads) for conversion tracking and audience targeting. The structural similarity of the `/config`-driven, WebSocket-adjacent delivery pattern between the Bitdefender-tracked cluster and SourTrade is notable, but the source reporting explicitly declines to confirm the current SourTrade samples belong to the same operator or malware family — this record therefore documents the SourTrade delivery mechanism as directly evidenced, and references the JSCEAL/WeevilProxy/Trojan.Agent.GOSL cluster strictly as a related, unconfirmed predecessor/adjacent campaign rather than as a confirmed attribution.

Defenders should treat the entire chain — ad referral, landing-page fingerprinting, ServiceWorker/SharedWorker registration, `/config` retrieval, and the resulting same-origin executable download — as the unit of detection, since any single network artifact (a clean Bun runtime fetch, a JSON config response, a per-victim-unique file hash) appears benign in isolation.