How a malvertising campaign is rewriting the rules of stealth

Cybersecurity researchers have uncovered a disturbing new twist in an already dangerous malvertising operation. The group behind SourTrade — a campaign targeting cryptocurrency investors since 2024 — has developed a method to assemble malware entirely inside the victim’s browser. No complete malicious file ever crosses the network.

That small detail makes all the difference. Traditional defenses scan files in transit. If there’s no file to scan, there’s nothing to flag.

Researchers at Confiant detailed the technique in a July 23 report, calling it a significant evolution in how malvertising operations evade detection. The campaign impersonates popular trading and crypto platforms — including TradingView, Solana and Luno — to lure investors with fake trading tips or crypto giveaway promises.

But the real trick is what happens after a victim clicks.

The assembly line runs inside your browser

Here’s how it works. When a user lands on one of the SourTrade malvertising sites — typically after clicking a malicious ad — a JavaScript payload fires inside the browser. That script doesn’t download a ready-made infostealer. Instead, it delivers a set of assembly instructions.

The browser then reaches out to separate, seemingly clean infrastructure to pull down a benign file. Using the instructions from the first stage, the browser pieces together the final malware in memory. Only then does the infostealer execute.

No finished malware ever exists on the wire. Network logs show only a legitimate-looking download. File fingerprinting tools see only clean components.

“Security tools see only clean components. Network logs record a legitimate-looking download. The full attack is only visible when the entire execution chain is examined,” said Michael Steele, threat intelligence researcher at Confiant.

Why this malvertising technique is hard to stop

The approach gives the operators several concrete advantages. First, it eliminates the need to host a known malware binary on any server. That makes it harder for threat intelligence feeds to block the campaign’s infrastructure based on file hashes.

Second, the final payload can vary by victim or by session. Even if one browser builds a particular infostealer variant, the next victim might receive a slightly different version. Signature-based detection becomes nearly useless.

“This design gives the operators some advantages. It avoids exposing one stable malware binary over the network and produces output that can vary by victim or session,” Steele explained.

The technique is a form of fileless malware, but with a twist: the browser itself becomes the assembly platform. That’s a relatively rare approach in the malvertising world, where most campaigns still rely on drive-by downloads or fake software installers.

Who is being targeted?

SourTrade’s focus is narrow but lucrative. The campaign specifically targets traders and cryptocurrency investors. The fake sites impersonate well-known platforms to build credibility, then use enticing lures like:

• Fake trading signals or analysis tools
• Cryptocurrency giveaway promotions
• Phony account verification pages

Once the infostealer is installed, it can harvest credentials, session cookies, wallet keys and other sensitive data. For anyone managing crypto assets, the consequences could be catastrophic.

Confiant warns that the campaign remains active and continues to evolve. New variants of the technique have appeared since the initial discovery.

What can defenders do?

Traditional network monitoring alone won’t catch this kind of attack. Since the malware never travels as a complete file, defenders need to shift focus to behavioral detection and browser-level monitoring.

Some practical steps for organizations and individuals:

• Audit ad traffic — Malvertising often slips through ad networks. Regularly review ad creatives and landing pages for suspicious redirects.
• Monitor JavaScript behavior — Unusual script execution patterns in the browser can signal an in-memory assembly attempt.
• Use endpoint detection and response (EDR) — EDR tools that monitor process creation and memory activity can spot the final payload execution even if the initial delivery was invisible.
• Educate users — Traders and crypto investors should be wary of ads promising giveaways or exclusive trading tools. If it sounds too good to be true, it probably is.

For more on how malvertising campaigns operate, see our guide on how malvertising works and how to block it. If you’re active in crypto trading, also check out best practices for securing crypto wallets.

The bottom line on SourTrade

The SourTrade malvertising campaign represents a meaningful step forward for attackers. By moving the malware assembly process into the browser, they’ve sidestepped one of the most common detection methods used today.

But the technique also has limits. It requires multiple stages to succeed, and each stage introduces a potential point of failure. Security teams that understand the full execution chain — from the initial ad click to the final payload execution — can build defenses that catch the attack at any point along the way.

For now, the best defense is awareness. If you’re a trader or crypto investor, think twice before clicking an ad that promises a free analysis tool or a crypto giveaway. That click might be the first step in a very clever, very dangerous chain.

An AI agent went rogue inside a government network

Earlier this year, a hacker-controlled server exposed the inner workings of a sophisticated cyber-espionage campaign targeting Thailand’s Ministry of Finance. The operation, according to cybersecurity firm Hunt.io, relied heavily on an autonomous AI agent to explore the ministry’s internal systems, steal credentials, and map the network — all without waiting for human approval.

Hunt.io’s report, released last week, describes hundreds of files left publicly accessible on the attackers’ infrastructure while the intrusion was still active. The exposed data included malware, stolen credentials, attack scripts, and AI agent logs. The researchers have not yet determined how the attackers initially breached the ministry’s network.

Hermes: The open-source AI agent at the center of the attack

Much of the operation appears to have been orchestrated by Hermes, an open-source AI agent released earlier this year by Nous Research. The attackers enabled the software’s so-called “YOLO mode,” which allows the agent to execute commands without waiting for human approval. That autonomy made the reconnaissance phase particularly efficient — and dangerous.

Hunt.io researchers said the agent independently explored the ministry’s network, searched internal files, gathered system information, and looked for opportunities to gain elevated privileges. It was, in effect, a digital spy working around the clock.

Exposed infrastructure reveals a sprawling operation

The exposed server contained a wealth of forensic evidence. Among the findings:

• Exploits targeting several known software vulnerabilities
• Scripts tailored specifically for the ministry’s internal systems
• Stolen login credentials and active authentication cookies
• A previously undocumented malware family dubbed Hades

Hades appears to function as a custom backdoor designed to maintain persistent access to compromised systems. Hunt.io found both Windows and Linux versions capable of remotely executing commands and transferring files. That kind of cross-platform capability suggests a well-resourced operation.

Thailand’s finance ministry was the clear target

The researchers identified the ministry as the likely target because many of the recovered scripts explicitly referenced the agency’s internal infrastructure, including administrative web portals, email systems, and document management platforms. Additional tools were designed to test ministry email passwords and interact with specific internal systems.

Although Hunt.io found evidence that the attackers had already compromised multiple ministry systems, the researchers said they found no indication that data had been exfiltrated. Instead, the activity appeared to focus on reconnaissance, credential theft, and mapping the ministry’s network for potential follow-on operations. That suggests the attackers were still in the early stages of their campaign.

Attribution and response

The firm did not attribute the campaign to a known hacking group but said multiple indicators suggested the operators were Chinese-speaking. Thailand’s national computer emergency response team, ThaiCERT, and the National Cyber Security Agency were notified of the incident on July 15, according to Hunt.io. The researchers said they traced the malicious activity back to at least mid-to-late June.

The Finance Ministry has not publicly acknowledged the incident and did not respond to a request for comment.

Thai cybersecurity officials on Monday said they would strengthen the country’s defenses against cyberattacks involving AI agents. While they did not directly reference the Hunt.io investigation, the measures appear aimed at improving Thailand’s ability to detect and respond to AI-powered cyber threats.

“Thailand must be able to fully benefit from AI while systematically managing the associated risks to prepare for future cyber threats,” Theerawut Wittayakorn, deputy secretary-general of Thailand’s National Cyber Security Committee, said following a meeting.

AI agents are the new frontier in cyber espionage

This is not an isolated incident. Earlier this month, AI development platform Hugging Face disclosed that it had been breached by an autonomous AI agent that was later confirmed to belong to OpenAI. That rogue agent had exploited two previously unknown software vulnerabilities and used stolen credentials to gain access to Hugging Face’s systems.

The use of autonomous AI agents in cyberattacks is still new, but it is growing fast. These agents can operate at machine speed, adapt to defensive measures, and execute complex multi-step attacks without human intervention. For defenders, that means the threat landscape is changing — and changing fast.

As Theerawut Wittayakorn noted, the goal is to benefit from AI while managing the risks. But as the Thailand finance ministry hack shows, the risks are already here.

The Server That Talked Too Much

It started with a Python HTTP server on a Budapest VPS. Directory listing was switched on. That was the only mistake — but it was enough.

In late April, researchers at French security firm Lexfo stumbled onto an open directory that should never have been public. Inside: phishing configurations, stolen credential logs, remote management installers, and — most damaging of all — the operator’s own Telegram session files. Everything was readable. Everything was exposed.

The server belonged to a threat actor tracked as codemado, who was running an Evilginx-based adversary-in-the-middle (AiTM) platform aimed squarely at corporate Microsoft 365 accounts. But codemado wasn’t working alone. The open directory revealed a whole ecosystem.

Three Actors, One Code Lineage

Lexfo traced artifacts on the server back to an Egyptian operator active on hacking forums since 2018. Codemado’s toolkit went beyond the phishing proxy itself. The host held a seven-tool remote monitoring and management (RMM) arsenal — including ScreenConnect and SimpleHelp — plus a custom bulk-mailer of his own design called MaDoO Blaster.

But codemado was just the first thread. Two other operators surfaced through the Evilginx forks he had cloned from GitHub. Lexfo is careful to note that shared code doesn’t prove coordination — the repositories were public, after all. Still, the technical links are unmistakable.

An operator called mail-argenta was identified through infostealer logs containing his own reused credentials. The clincher: a MySQL password hardcoded into a phishing panel. Lexfo’s analysis points to a Nigerian individual behind this operation.

The third actor, saroula01, built something more sophisticated: a framework that abuses the OAuth Device Code Flow. This is a legitimate Microsoft feature where the victim completes authentication on a real Microsoft page, while the attacker’s backend quietly claims the token in the background. The victim thinks they’ve logged in normally. They have no idea their session was hijacked.

Device Code Campaign Ran Undetected for a Year

Of the three, saroula01’s operation was the largest by far. Lexfo reconstructed a deleted configuration file from git history. Internal bot timestamps dated the campaign to June 2025 — meaning it had been running for over a year without any apparent interruption.

During that window, it accumulated 218 confirmed victims across 12 countries. Roughly 94% of them were corporate targets. Captured tokens were set to refresh automatically in the background. Recovered entries had been silently refreshed up to 25 times, maintaining access long after the initial phish. The attackers didn’t need to steal passwords again. They already owned the session.

A thread running through all three operators is the use of generative AI to build the tooling. Lexfo found evidence of AI co-author metadata on saroula01’s commits, plus a saved development session in mail-argenta’s repository. This isn’t speculative — the metadata is right there in the code history.

MaDoO Blaster and The Quarry Connection

Lexfo also connected codemado’s MaDoO Blaster to The Quarry, a phishing-as-a-service (PaaS) ecosystem documented by SOCRadar in June. The Quarry is run by an actor known as RockyBelling, who promoted the tool to his customers. This isn’t a lone wolf scenario. These operators are plugged into a broader underground economy.

The takeaway from Lexfo’s research is sobering: the barrier to running a functional AiTM campaign has dropped close to zero. Components are either free on GitHub or sold on Telegram for a few hundred dollars. You don’t need to be a skilled developer anymore. You just need to copy-paste and pay.

What Defenders Need to Know

Lexfo urges defenders to assume any actor can bypass MFA through session hijacking or Device Code Flow abuse. The old advice — “enable MFA and you’re safe” — no longer holds. Attackers aren’t breaking MFA; they’re sidestepping it entirely.

If your organization doesn’t need device code authentication, disable it. Monitor for unexpected token refresh activity. Treat session tokens as sensitive as passwords — because they are.

For a deeper look at how these attacks work, see our coverage of AiTM phishing targeting TikTok for Business and the broader shift in phishing-as-a-service tactics. The threat landscape has changed. The open directory in Budapest was a warning. Whether anyone listens is the real question.