SourTrade Campaign Uses Browser-Based Malware Assembly to Evade Detection
Summary
A malvertising campaign linked to SourTrade uses fake Solana, Luno, and TradingView pages to assemble malware in browsers. Confiant says randomized, session-specific builds and same-origin delivery help evade static detection; the current payload is undisclosed.
Key points
- Fake Solana, Luno, and TradingView pages target retail traders and cryptocurrency investors.
- The campaign has been active since late 2024 and targets users across 25 languages and 12 countries, primarily in Asia Pacific and Latin America.
- Filtering redirects researchers, scanners, and security bots to blank pages.
- Service workers and a shared worker assemble malware in the browser from components, using randomized session-specific inputs to produce unique file hashes.
- The resulting executable is delivered through a same-origin download path; the article says no finished file is transmitted over the network.
- Since April, SourTrade has reportedly shifted from using StreamSaver to same-origin ServiceWorker delivery.
- Confiant did not disclose the current payload. A Bitdefender report on an earlier campaign variant described capabilities including credential and wallet-data theft, keylogging, and persistence.
Article Details
- Attack Vectors
- Malvertising directs retail traders and cryptocurrency investors to fake Solana, Luno, and TradingView pages.
- Malicious JavaScript uses a ServiceWorker and SharedWorker to retrieve components and assemble an executable locally in browser memory.
- The landing page uses randomized, session-specific configuration parameters to produce malware files with unique hashes.
- Filtering checks redirect researchers, scanners, and security bots to blank pages.
- Defensive Notes
- Avoid downloading financial or cryptocurrency apps from social media advertisements or sponsored search results.
- Obtain executable files from the company’s official website and verify the installer’s digital signature and publisher before running it.
MITRE ATT&CK
T1036 · MasqueradingFake Solana, Luno, and TradingView pages impersonate recognizable services to lure victims.T1040 · Network SniffingBitdefender reported that the related campaign payload could intercept user network traffic while acting as a proxy.T1056.001 · KeyloggingBitdefender reported that the related campaign payload could record keystrokes.T1059.007 · JavaScriptMalicious JavaScript on the landing pages coordinates browser-side malware assembly.T1105 · Ingress Tool TransferThe browser retrieves remote components that are used with locally generated bytes to build the payload.T1113 · Screen CaptureBitdefender reported that the related campaign payload could take screenshots.T1189 · Drive-by CompromiseThe campaign uses malvertising and fake landing pages to direct targets to malicious web content.T1539 · Steal Web Session CookieBitdefender reported that the related campaign payload could collect cookie data.