A sophisticated malvertising campaign known as SourTrade has been actively targeting cryptocurrency users since late 2024. This operation employs deceptive advertisements to lure individuals into visiting counterfeit versions of well-known trading and exchange platforms, including TradingView, Solana, and Luno. The campaign has primarily focused on users across regions such as Asia-Pacific, Latin America, Africa, Australia, and Great Britain.
Upon visiting these fraudulent sites, users are subjected to a unique attack method. Instead of delivering a pre-compiled malicious file, SourTrade utilizes the victim’s own browser to assemble the malware locally. This process involves several steps:
- ServiceWorker Registration: The malicious landing page registers a ServiceWorker, a browser feature that can intercept and control network requests.
- SharedWorker Activation: A SharedWorker is initiated to receive instructions for constructing the final payload.
- Component Delivery: The attackers provide various components, including a template, a clean Bun runtime, encrypted data, and session-specific values.
- Local Assembly: The browser combines these elements in memory, creating a unique Windows executable tailored to each victim or session.
This method effectively evades traditional security measures that rely on file-hash detection, as each generated file is distinct. Additionally, the final payload is delivered through a same-origin browser download path controlled by the ServiceWorker, making the download appear legitimate to the user.
To further evade detection, SourTrade employs visitor fingerprinting techniques. If a visitor is identified as a researcher, bot, or otherwise unwanted traffic, they are presented with a blank, harmless page. Only selected targets receive the counterfeit platform page and the associated malicious content.
The campaign’s use of localized advertisements in multiple languages increases its reach and effectiveness. By impersonating trusted brands and utilizing advanced cloaking techniques, SourTrade poses a significant threat to cryptocurrency users worldwide.
In the broader context, SourTrade exemplifies the evolving sophistication of malvertising campaigns. By leveraging browser features to construct malware dynamically, attackers can bypass traditional security defenses and deliver tailored payloads to specific targets. This trend underscores the need for continuous advancements in cybersecurity measures to detect and mitigate such innovative threats.
