How a malvertising campaign is rewriting the rules of stealth
Cybersecurity researchers have uncovered a disturbing new twist in an already dangerous malvertising operation. The group behind SourTrade — a campaign targeting cryptocurrency investors since 2024 — has developed a method to assemble malware entirely inside the victim’s browser. No complete malicious file ever crosses the network.
That small detail makes all the difference. Traditional defenses scan files in transit. If there’s no file to scan, there’s nothing to flag.
Researchers at Confiant detailed the technique in a July 23 report, calling it a significant evolution in how malvertising operations evade detection. The campaign impersonates popular trading and crypto platforms — including TradingView, Solana and Luno — to lure investors with fake trading tips or crypto giveaway promises.
But the real trick is what happens after a victim clicks.
The assembly line runs inside your browser
Here’s how it works. When a user lands on one of the SourTrade malvertising sites — typically after clicking a malicious ad — a JavaScript payload fires inside the browser. That script doesn’t download a ready-made infostealer. Instead, it delivers a set of assembly instructions.
The browser then reaches out to separate, seemingly clean infrastructure to pull down a benign file. Using the instructions from the first stage, the browser pieces together the final malware in memory. Only then does the infostealer execute.
No finished malware ever exists on the wire. Network logs show only a legitimate-looking download. File fingerprinting tools see only clean components.
“Security tools see only clean components. Network logs record a legitimate-looking download. The full attack is only visible when the entire execution chain is examined,” said Michael Steele, threat intelligence researcher at Confiant.
Why this malvertising technique is hard to stop
The approach gives the operators several concrete advantages. First, it eliminates the need to host a known malware binary on any server. That makes it harder for threat intelligence feeds to block the campaign’s infrastructure based on file hashes.
Second, the final payload can vary by victim or by session. Even if one browser builds a particular infostealer variant, the next victim might receive a slightly different version. Signature-based detection becomes nearly useless.
“This design gives the operators some advantages. It avoids exposing one stable malware binary over the network and produces output that can vary by victim or session,” Steele explained.
The technique is a form of fileless malware, but with a twist: the browser itself becomes the assembly platform. That’s a relatively rare approach in the malvertising world, where most campaigns still rely on drive-by downloads or fake software installers.
Who is being targeted?
SourTrade’s focus is narrow but lucrative. The campaign specifically targets traders and cryptocurrency investors. The fake sites impersonate well-known platforms to build credibility, then use enticing lures like:
- Fake trading signals or analysis tools
- Cryptocurrency giveaway promotions
- Phony account verification pages
Once the infostealer is installed, it can harvest credentials, session cookies, wallet keys and other sensitive data. For anyone managing crypto assets, the consequences could be catastrophic.
Confiant warns that the campaign remains active and continues to evolve. New variants of the technique have appeared since the initial discovery.
What can defenders do?
Traditional network monitoring alone won’t catch this kind of attack. Since the malware never travels as a complete file, defenders need to shift focus to behavioral detection and browser-level monitoring.
Some practical steps for organizations and individuals:
- Audit ad traffic — Malvertising often slips through ad networks. Regularly review ad creatives and landing pages for suspicious redirects.
- Monitor JavaScript behavior — Unusual script execution patterns in the browser can signal an in-memory assembly attempt.
- Use endpoint detection and response (EDR) — EDR tools that monitor process creation and memory activity can spot the final payload execution even if the initial delivery was invisible.
- Educate users — Traders and crypto investors should be wary of ads promising giveaways or exclusive trading tools. If it sounds too good to be true, it probably is.
For more on how malvertising campaigns operate, see our guide on how malvertising works and how to block it. If you’re active in crypto trading, also check out best practices for securing crypto wallets.
The bottom line on SourTrade
The SourTrade malvertising campaign represents a meaningful step forward for attackers. By moving the malware assembly process into the browser, they’ve sidestepped one of the most common detection methods used today.
But the technique also has limits. It requires multiple stages to succeed, and each stage introduces a potential point of failure. Security teams that understand the full execution chain — from the initial ad click to the final payload execution — can build defenses that catch the attack at any point along the way.
For now, the best defense is awareness. If you’re a trader or crypto investor, think twice before clicking an ad that promises a free analysis tool or a crypto giveaway. That click might be the first step in a very clever, very dangerous chain.
