Security researchers have discovered a large-scale malvertising campaign that uses fake cryptocurrency and trading websites to assemble malware inside the web browser of the victim, making it increasingly difficult to detect using traditional security tools.
A security firm named Confiant claims the operation has been in operation since late 2024 and primarily targets retail traders and cryptocurrency investors in 12 countries. Asia-Pacific and Latin America regions are particularly targeted. In addition to supporting 25 languages, the campaign employs sophisticated filtering techniques to prevent researchers, automated scanners, and security bots from reaching malicious sites, as well as redirecting researchers and automated scanners to harmless blank pages to avoid damage.
Security researchers, automated scanners, and bots are served empty pages before the fake websites are displayed in order to determine whether or not the users are legitimate targets. In contrast, retail traders and cryptocurrency investors receive convincing replicas of legitimate platforms when using selective filtering. By doing so, routine security scans are significantly reduced in the likelihood of detecting the infrastructure.
Users are presented with websites that appear legitimate that offer software downloads by impersonating popular platforms such as Solana, Luno, and TradingView. By utilizing JavaScript techniques, the websites construct malware locally within the victim's browser memory rather than delivering a malicious file directly to the victim.
It is said that the browser acts as a "local assembly pipeline" because it is capable of assembling malware rather than downloading a complete executable file.
As part of the attack, a Service Worker is registered to manage the download process, whereas a SharedWorker is created directly from JavaScript embedded within the webpage, so that the source code does not appear as a separate network request.
After receiving the configuration file, the worker requests instructions for assembling the malware, including a template, randomized session values, and instructions. Each download is uniquely generated based on randomized parameters, thus producing a unique file hash for each victim. By utilizing this approach, the malware can bypass static detection methods that depend upon identifying known file signatures.
Browsers download legitimate Bun runtimes from a secondary domain as part of the assembly process, and they combine them with attacker-controlled executable components and locally generated data as part of the assembly process. Since Bun is a legitimate component for building standalone Windows applications, attackers exploit this feature to disguise the final executable.
Each session generates a unique file hash based on a random seed and file size, reducing the effectiveness of hash-based malware detection.
By delivering the executable through the same domain that the website uses, the download appears legitimate from the browser's perspective, so that the download appears legitimate.
Despite receiving Microsoft's Mark-of-the-Web security tag, network-based detection and forensic analysis are significantly more difficult without a fully transmitted malicious file.
According to Confident, earlier versions of the campaign, tracked as SourTrade, used the open-source StreamSaver project to deliver malware.
Since April 2026, however, the operators have switched to using more sophisticated Service Worker-based delivery mechanisms.
Researchers did not publicly identify the malicious payload for this campaign, but they linked it to Bitdefender's previous findings, which documented malware capable of intercepting internet traffic, stealing passwords and browser cookies, logging keystrokes, capturing screenshots, harvesting cryptocurrency wallet data, and maintaining persistence on compromised systems for a period of time.
A Confident representative noted that the campaign does not exploit browser vulnerabilities or bypass Microsoft's Mark-of-the-Web (MotW) security features. Instead, it utilizes legitimate browser capabilities to deliver malware without transmitting a full executable over the network. In addition, researchers noted that there is currently no software patch available for this technique, which requires users to remain aware of and to practice safe software downloading practices to protect themselves.
Earlier versions of the campaign used the open-source StreamSaver project hosted on GitHub to facilitate malware downloads, allowing investigators to trace its evolution from earlier versions. The operators replaced that approach in April 2026 with a Service Worker-based download mechanism, which encapsulates the entire delivery process within the impersonated website, making it increasingly difficult to analyze the network and detect malware.
A security expert recommends downloading cryptocurrency and financial software from official vendor websites, avoiding sponsored advertisements or social media promotions, and verifying the digital signature and publisher of the application before installation. In light of the increasing stealthy techniques used by attackers to compromise users, these precautions remain critical.
In light of the increasing sophistication of cybercriminals' malware delivery techniques, campaigns such as SourTrade underscore the challenges that defenders face.
Through the use of legitimate browser functionality in order to assemble malware locally, attackers are able to bypass many traditional detection methods. It is recommended that you only download software from legitimate sources, verify digital signatures, and be wary of sponsored advertisements and promotional links relating to cryptocurrencies and financial institutions.
