The Operators of a well-known malvertising campaign have developed a novel technique to avoid detection: hiding their activity in the victim’s browser to secretly build and then deliver the final payload.
The new tactics by SourTrade, a prolific and evolving malvertising operation which has been active since 2024, have been detailed by cybersecurity researchers at Confiant.
SourTrade impersonates several well-known trading and cryptocurrency platforms, including TradingView, Solana and Luno, with the aim of targeting investors and traders with an infostealer.
As detailed in a blog post published on July 23, the campaign uses a range of malvertising lures to draw interest from potential victims, with many focused around trading tips or cryptocurrency giveaways. If the user visits one of these sites, SourTrade begins the process of stealthily delivering the payload.
The site does notdoes not distribute a complete payload malware at once. Instead, the malvertising site deliver assembly instructions to the victim’s browser, before it retrieves a clean file from separate infrastructure and then directs the browser to build the final malware in memory on the victim’s machine.
No finished malware ever exists on the network.
This design is used to counter file fingerprinting, a technique used by many cybersecurity defenses to help identify malicious activity, therefore freeing SourTrade to deliver the payload.
Michael Steele, threat Intelligence researcher at Confiant, said, “Security tools see only clean components. Network logs record a legitimate-looking download. The full attack is only visible when the entire execution chain is examined.” .
When the user visits the site, they have been directed to through malvertising, a JavaScript instruction prepares the browser for the constituent parts of the malware delivery. The initial stage of this is the delivery of the instructions used to piece together the malware.
After this, the remote components of the malware are built within the browser, after which it is executed and delivered. As this has been built in the browser, to any protections, the payload looks as if it should be trusted and safe – while in fact the victim is unaware an infostealer is being installed on their system.
“This design gives the operators some advantages. It avoids exposing one stable malware binary over the network and produces output that can vary by victim or session,” said Steele.
Researchers warned that SourTrade remains a widespread and evolving malvertising campaign.