Top Highlights
- Threat actors use sophisticated malvertising campaigns that dynamically generate malicious Windows executables within browsers by combining legitimate runtimes and attacker-controlled payloads, evading traditional detection methods.
- The attack chain leverages ServiceWorkers and streaming download techniques to assemble and deliver unique, session-specific malware payloads, making static signature-based detection ineffective.
- The exploits enable credential theft, keylogging, and remote access, but current analyses do not definitively attribute these capabilities to the observed malware samples, underscoring evolving threat complexity.
The Threat, Attack Techniques, and Targets
The operation called SourTrade is a type of malvertising campaign. It has been active since late 2024. The campaign impersonates trusted services like TradingView, Solana, and Luno. These impersonations target retail traders and cryptocurrency investors. Victims are located in 12 countries and see messages in 25 languages.
The attack begins on a malicious landing page. The page identifies visitors and gives different experiences. Some see an empty page, while others get a convincing fake of the impersonated service. The aim is to trick targeted victims into downloading malware.
The delivery uses advanced techniques. It registers a service worker and builds a shared worker in the victim’s browser. The shared worker requests a configuration that contains a second URL and random values. From this URL, the browser downloads a clean Bun runtime. The code then uses this runtime to create a malicious executable. It assembles a unique file for each victim. The file is built using the Bun runtime, encrypted byte streams, and attacker-controlled code. No complete malware files are stored on any server. Instead, the final malicious file is assembled in the victim’s browser.
This attack does not rely on exploiting browser vulnerabilities or removing Mark of the Web (MotW). It manipulates browser features and streams the malicious payload in real-time.
Impact, Security Implications, and Remediation Guidance
This attack can result in serious security issues. It can lead to credential theft, keylogging, traffic interception, wallet theft, or remote access. Because each system receives a different version of malware, detection can be difficult. The malware’s design makes simple hash-based detection less effective since each payload is unique per session.
The malware is delivered as a partially assembled Windows executable. It is sent as a stream of bytes, not as a stored file. The use of legitimate tools like Bun and JavaScriptCore makes detection harder for traditional security solutions.
There is currently no specific software patch to block this attack. Defenders should carefully examine the entire attack chain. This includes the ad referral, landing page, configuration request, runtime download, and service worker download process. Monitoring these steps can help detect unusual activity.
For now, the best defense is to download trading and wallet software only from official vendor sites. Installing software from third-party ads or links is risky.
Remediation guidance should be obtained from the relevant security vendors or authorities. They can provide the latest techniques and tools to detect and mitigate this sophisticated threat.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
