Actor Profile

SourTrade is a malvertising campaign (not a named threat actor group) operating since late 2024. The campaign impersonates legitimate trading platforms—TradingView, Solana, and Luno—to distribute malware to retail traders and cryptocurrency investors. The operation spans 12 countries and deploys landing pages in 25 languages. Attribution to a specific threat actor has not been established; Confiant named no actor behind the campaign. The motivation is financial gain through credential theft, wallet compromise, and potential deployment of stealer malware previously linked to related clusters (JSCEAL/WeevilProxy), though payload attribution to current samples remains unconfirmed.

TTPs (Tactics, Techniques, Procedures)

The campaign employs a novel delivery mechanism that assembles malware client-side within the victim's browser. Initial access occurs via malvertising (T1189 - Drive-by Compromise). Landing pages fingerprint visitors (T1592.004 - Gather Victim Identity Information: Client Configurations) to evade researcher detection, serving empty pages to suspected bots while delivering malicious content to selected targets. The attack leverages ServiceWorkers and SharedWorkers to orchestrate delivery without fetching external worker scripts. A /config endpoint returns Base64-encoded PE headers, section tables, and malicious JavaScriptCore bytecode. The browser retrieves a legitimate Bun runtime from a secondary domain (purelogicbox[.]org), then combines it with pseudorandom AES-CTR byte streams and attacker-supplied executable material per a byte-copy template. Each victim receives a unique hash due to rotating seeds (T1027 - Obfuscated Files or Information), evading hash-based detection. The assembled executable is streamed via a hidden iframe with Content-Disposition headers, preserving Mark of the Web but attributing the download to the landing page rather than the runtime source. Earlier iterations used the open-source StreamSaver.js library from GitHub Pages. Related clusters have delivered JSCEAL/WeevilProxy stealer payloads capable of credential theft, keylogging, traffic interception, and remote access, though direct payload linkage to current SourTrade samples is not confirmed.

Targets & Patterns

SourTrade targets retail traders and cryptocurrency investors across the financial services, cryptocurrency, and trading sectors. The campaign operates in 12 countries with landing pages localized into 25 languages, indicating broad geographic and linguistic targeting to maximize victim reach. By impersonating high-profile platforms like TradingView, Solana, and Luno, the operation exploits user trust in legitimate trading and wallet services. The targeting pattern suggests opportunistic victim selection driven by malvertising distribution rather than strategic intelligence collection, consistent with financially motivated cybercrime. The fingerprinting mechanism filters out security researchers and automated analysis systems, focusing delivery on genuine end-users likely to execute downloaded files. The choice of cryptocurrency and trading themes aligns with high-value targets holding digital assets and financial credentials.

Historical Context

SourTrade has operated since late 2024, with Confiant tracking related activity through April 30, 2026. Earlier versions of the campaign loaded the open-source StreamSaver.js library from its author's GitHub Pages address, leaving download paths pointing to the GitHub URL. Current iterations have evolved to embed the streaming architecture directly in landing pages, retaining message names like "streamsaver:" but eliminating the external GitHub fetch. Bitdefender documented a related TradingView malvertising cluster in September 2025, identifying final payloads as the JSCEAL stealer (Check Point naming) and WeevilProxy (WithSecure naming). Bitdefender's reporting also mentioned a modified Bun executable, though their September 2025 post referenced a loader detection named Variant.DenoSnoop.Marte.1 with no explicit mention of Bun. Confiant identifies shared campaign and executable characteristics between the September 2025 cluster and current SourTrade samples but does not confirm identical payloads. The evolution from GitHub-hosted libraries to fully embedded delivery mechanisms demonstrates iterative OPSEC improvements to reduce forensic attribution and evade network-based detections.

Defensive Recommendations

  • Monitor for ServiceWorker and SharedWorker registrations from unexpected or newly registered domains, particularly those mimicking financial or cryptocurrency platforms (T1189 detection).
  • Implement network inspection for /config or similar configuration endpoints returning large Base64-encoded payloads, especially when followed by secondary-domain fetches of legitimate runtime binaries like Bun or Deno.
  • Deploy behavioral detection for browser processes initiating streamed downloads via hidden iframes with Content-Disposition attachment headers, correlating with prior worker registrations.
  • Block or alert on downloads of executable files assembled client-side where no complete binary traversed the network as a single artifact; examine full HTTP transaction chains rather than relying solely on file hash IOCs.
  • Educate users to install trading platforms, wallets, and financial software exclusively from vendor-official websites, never from advertisements or search results, and verify domain authenticity before download (T1189 mitigation).
  • Leverage Confiant's published IOCs: 96 malicious domains and three SHA-256 hashes to populate blocklists and SIEM correlation rules, while recognizing that per-session hash rotation limits static signature efficacy.