# SourTrade Malvertising: ServiceWorker-Orchestrated In-Browser Assembly Builds a Unique Windows Executable Per Victim

> The 'SourTrade' malvertising operation, active since late 2024, impersonates TradingView, Solana, and Luno across malicious Google Ads, Meta, and Twitter/X ad placements to target retail traders and crypto investors in 12 countries across 25 languages. Instead of hosting a finished malicious file, landing pages register a ServiceWorker and SharedWorker that fetch a template, a clean Bun JavaScript runtime, an encrypted Base64 configuration, and a per-session AES-CTR seed from a `/config` endpoint, then assemble a unique Windows PE executable entirely in the browser/stream, defeating hash-based detection by design.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1696
- **ID:** TL-2026-1696
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SourTrade is a long-running malvertising campaign, first observed operating in late 2024 and still active as of the July 2026 Confiant disclosure, that lures retail traders and cryptocurrency investors by impersonating TradingView, Solana, and Luno in sponsored advertisements distributed through Google Ads, Meta/Facebook, and Twitter/X ad ecosystems across 12 countries (reported targeting spans Japan, Thailand, South Korea, Taiwan, Hong Kong, Australia, Bolivia, Brazil, Nigeria, South Africa, Türkiye, and Great Britain) in 25 languages.

Landing pages implement a visitor-fingerprinting/cloaking layer that serves a blank, harmless page to suspected researchers, bots, and automated scanners while routing selected targets to convincing brand-impersonation pages. Rather than distributing a finished executable, the campaign moves malware construction into the victim's own browser: a page-scoped ServiceWorker (registered at `/sw.js`, with source embedded inline to avoid a separate network fetch) intercepts same-origin requests and manages a streamed download; a SharedWorker built from an embedded JavaScript blob (so it is never fetched from a visible URL) requests a `/config` endpoint. That endpoint returns a JSON assembly profile containing a byte-copy 'template' array, a `standaloneUrl` pointing to a clean Bun JavaScript runtime binary, and a per-session AES-CTR seed and size. The worker generates a large pseudorandom byte stream via AES in counter mode, then follows the template to interleave ranges of the clean Bun runtime, the generated pseudorandom stream, and attacker-supplied Base64-encoded blobs (the PE header, section table, and a `.bun` section carrying malicious JavaScriptCore bytecode) into a complete Windows Portable Executable. Because the AES-CTR seed and size are unique per victim/session, no two assembled files share a hash, even though the embedded malicious logic is constant — 'no finished malware ever exists on the network.' The finished stream is handed to the ServiceWorker, which serves it as a same-origin download (via a hidden iframe navigation and a `Content-Disposition: attachment` response header), so the resulting file's Mark-of-the-Web record attributes it to the landing-page origin rather than to the true component sources (the Bun-runtime host and the attacker's config endpoint). Multiple independent write-ups (Confiant, GBHackers, Cybersecurity News, Cyberpress) corroborate a secondary infrastructure domain, `purelogicbox.org`, used to host the clean Bun 'standalone' runtime fetched during assembly; a BeaconBeagle configuration-search lookup against this domain returned no existing C2 correlation records at time of research. Confiant's disclosure additionally identifies approximately 96 malicious domains associated with the campaign to date, alongside three referenced-but-unpublished SHA-256 samples; multiple secondary outlets (Cybersecurity News, Cryptika) present what they describe as SHA-256 IOC tables for these samples, but cross-checking their published hash strings against an independent re-fetch of the same pages produced mutually inconsistent digit sequences (leading/trailing-digit drift consistent with a table-scraping artifact), so no specific hash value is reproduced in this record pending an authoritative, internally-consistent publication.

The delivery mechanism itself evolved: campaign variants observed through April 30, 2026 relied on a GitHub Pages-hosted copy of the StreamSaver.js library to manipulate Mark-of-the-Web attribution; the current ServiceWorker/SharedWorker/Bun-assembly technique documented by Confiant on July 23, 2026 supersedes that approach and represents an operational evolution toward a harder-to-detect, fully in-browser build pipeline. The Hacker News reported on Confiant's findings on July 25, 2026, and independent outlets GBHackers, Cybersecurity News, Cyberpress, and Cryptika published their own technical analyses within roughly a day of the original disclosure.

Attribution and final-payload capability remain explicitly unconfirmed for the current SourTrade samples. Confiant's public disclosure references three unpublished SHA-256 samples and does not disclose specific IOC values for the current wave, and does not assert a malware-family attribution. A separate, well-documented Bitdefender campaign — 'The Scam That Won't Quit: Malicious TradingView Premium Ads Jump from Meta to Google and YouTube' (published September 27, 2025, independently corroborated by Cybersecurity Asia, iTWire, SC World, and KBI Media) — tracked a related TradingView-impersonation malvertising cluster whose final payload was identified as JSCEAL (Check Point's name) / WeevilProxy (WithSecure's name) / Trojan.Agent.GOSL (Bitdefender's final-payload detection name), an infostealer/RAT hybrid capable of full network traffic interception (acting as a local proxy), keylogging, screenshot capture, and cookie/password/cryptocurrency-wallet theft, distributed via an initial loader Bitdefender detects as Variant.DenoSnoop.Marte.1 persisting through a Windows Scheduled Task named `EdgeResourcesInstallerV12-issg`, with macOS (Variant.MAC.Amos.9) and Android (Android.Trojan.Dropper.AVV, Android.Trojan.Banker.AVM) variants also observed, using an oversized (700MB+) downloader for anti-sandbox evasion, and a shift from plaintext HTTP C2 on ports 30303/30308 (routes `/s`, `/set`, `/q`, `/query`) to WebSocket C2 on port 30000 with a `/config` route. Bitdefender's monitoring of this related cluster covered 'the past year' as of its September 2025 publication (placing its earliest tracked activity around September 2024) and identified over 500 rotating domains and subdomains supporting the operation, plus third-party analytics/ad-tracking abuse (PostHog, Facebook Pixel, Microsoft Ads) for conversion tracking and audience targeting. The structural similarity of the `/config`-driven, WebSocket-adjacent delivery pattern between the Bitdefender-tracked cluster and SourTrade is notable, but the source reporting explicitly declines to confirm the current SourTrade samples belong to the same operator or malware family — this record therefore documents the SourTrade delivery mechanism as directly evidenced, and references the JSCEAL/WeevilProxy/Trojan.Agent.GOSL cluster strictly as a related, unconfirmed predecessor/adjacent campaign rather than as a confirmed attribution.

Defenders should treat the entire chain — ad referral, landing-page fingerprinting, ServiceWorker/SharedWorker registration, `/config` retrieval, and the resulting same-origin executable download — as the unit of detection, since any single network artifact (a clean Bun runtime fetch, a JSON config response, a per-victim-unique file hash) appears benign in isolation.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1620 Reflective Code Loading
- T1497 Virtualization/Sandbox Evasion
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer

## Sources

- [Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable](https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html)
- [SourTrade: Browser-Assembled Malware Delivered Through Malvertising](https://blog.confiant.com/p/sourtrade-browser-assembled-malware)
- [SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design](https://gbhackers.com/sourtrade-browser-assembled/)
- [SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection](https://cybersecuritynews.com/sourtrade-malvertising-malware/)
- [Hackers Abuse Service Workers to Assemble Malware Inside Web Browsers](https://cyberpress.org/service-worker-malware-assembly/)
- [SourTrade Malvertising Builds Unique Malware Inside Victims' Browsers to Evade Detection](https://www.cryptika.com/sourtrade-malvertising-builds-unique-malware-inside-victims-browsers-to-evade-detection/)
- [The Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube](https://www.bitdefender.com/en-us/blog/labs/the-scam-that-wont-quit-malicious-tradingview-premium-ads-jump-from-meta-to-google-and-youtube)
- [Bitdefender Finds Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google, YouTube](https://cybersecurityasia.net/bitdefender-finds-scam-tradingview-youtube/)
- [The Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube](https://itwire.com/guest-articles/guest-research/the-scam-that-won%E2%80%99t-quit-malicious-%E2%80%98tradingview-premium%E2%80%99-ads-jump-from-meta-to-google-and-youtube.html)
- [Fake TradingView Premium ad campaign spreads to Google Ads, YouTube](https://www.scworld.com/news/fake-tradingview-premium-ad-campaign-spreads-to-google-ads-youtube)
- [Bitdefender Report: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube](https://kbi.media/press-release/bitdefender-report-malicious-tradingview-premium-ads-jump-from-meta-to-google-and-youtube/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1696