SourTrade: The Browser Becomes an In-Memory Malware Factory

The SourTrade malvertising campaign assembles malware directly in the victim's browser memory using legitimate web APIs. The technique bypasses static and forensic detection based on file hashes and network traffic analysis.

The SourTrade malvertising campaign assembles the malicious payload directly in the victim's browser memory rather than transmitting a complete executable over the network. According to analysis published July 25, 2026 by Confiant and reported by BleepingComputer and CyberWire, the technique — active with this architecture since April 2026 — exploits legitimate web APIs such as Service Worker, SharedWorker, and Fetch to turn the browser into a local compilation pipeline. The result is a same-origin download with Mark-of-the-Web that appears legitimate, evading traditional network-based controls and forensic analysis based on hashes of transferred files.

Key Takeaways

SourTrade has operated since late 2024 across 12 countries, primarily in Asia-Pacific and Latin America, with fake sites impersonating Solana, Luno, and TradingView and anti-researcher filters in 25 languages.
The malware is not downloaded as a complete file: the browser receives templates and randomized parameters, assembling the payload in memory by combining it with the Bun runtime downloaded from a secondary domain.
Service Worker manages the download disguised as same-origin from the landing page domain; SharedWorker acts as the assembly engine with randomized seed and size per session.
No software patch is available for this technique, which does not exploit browser vulnerabilities but abuses legitimate capabilities of modern web APIs.

How the Browser Becomes a Malware Factory

The attack chain begins with landing pages that replicate authentic financial platforms. SourTrade operators have implemented a filtering system in 25 languages that redirects scanners, bots, and researchers to blank pages, serving malicious content only to targets deemed valid. The campaign has been active since late 2024, with a significant architectural transition in April 2026.

The technical novelty lies in the delivery mechanism. Instead of serving a precompiled executable, the attacker infrastructure returns assembly instructions to the browser. As Confiant researchers document, the /config endpoint is not a conventional download response: it is an assembly response providing the templates and inputs necessary for local file construction. The browser — to quote Confiant directly via BleepingComputer — functions as "a local assembly pipeline for the malware".

The process involves two primary components. The Service Worker operates as a download manager, handling the data flow and presenting the user with a download that appears to originate from the landing page domain, complete with Mark-of-the-Web. The SharedWorker serves as the assembly engine, combining the received template with randomized parameters — variable seed and size per session — to generate a file with a unique hash every time. This randomness renders static hash-based signatures ineffective.

A third element completes the assembly: the Bun runtime, a legitimate component downloaded from a separate secondary domain distinct from the command infrastructure. The browser combines this clean runtime with the attacker-controlled parts, producing the final payload entirely in memory. As Confiant notes via CyberWire: "[SourTrade] does not distribute finished malware. Instead, it delivers assembly instructions to the victim's browser, retrieves a clean legitimate file from separate infrastructure, and directs the browser to build the final malware in memory on the victim's machine. No finished malware ever exists on the network."

"From the browser's point of view, the user is downloading an executable from the landing page domain"
— Confiant researchers, via BleepingComputer

Why Traditional Detection Fails

The SourTrade technique challenges the perimeter security paradigm on multiple fronts. Network-based controls analyzing in-transit traffic do not detect suspicious executables because no finished file crosses the network. Post-compromise forensic systems searching for disk artifacts find a legitimate download with Mark-of-the-Web, apparently originating from the landing page domain. Even sandboxes analyzing file hashes face a puzzle: every session generates a file with a different signature, despite being functionally identical.

The apparent same-origin nature of the download — from the landing page domain — represents a further cognitive barrier for analysis. As Confiant researchers specify via BleepingComputer: from the browser's perspective, the user is downloading an executable from the landing page domain. The true multi-source provenance — template from one server, runtime from another, local assembly — is completely masked from the user and conventional monitoring tools.

It must be emphasized that the technique does not exploit browser vulnerabilities nor bypass the Mark-of-the-Web mechanism. Primary sources explicitly deny that SourTrade uses zero-days or security flaws: it is pure abuse of web APIs designed for legitimate purposes. This distinction is technologically relevant because it eliminates the possibility of a traditional vendor fix: no software patch can disable Service Worker and SharedWorker capabilities without breaking legitimate web functionality.

Context with CVE-2026-3910 and Dossier Limitations

The editorial brief includes CVE-2026-3910, a vulnerability in Chrome's V8 implementation with a CVSS 8.8 HIGH score according to the National Vulnerability Database, affecting versions prior to 146.0.7680.75. The dossier does not establish any direct link between this CVE and the SourTrade technique: primary campaign sources do not cite it, and Confiant's analysis explicitly describes the approach as non-vulnerability-based. CVE-2026-3910 remains a separate technical context element, useful for understanding the broader Chrome JavaScript engine risk landscape but not integrable into the documented attack chain.

Regarding limitations, the dossier does not specify the exact nature of the final payload generated by the ServiceWorker variant — Confiant has not publicly disclosed these details. No figures emerge on confirmed victim counts nor attributions on operator identity. Previous campaign variants, documented by Bitdefender in 2025, included traffic proxy capabilities, keylogging, and screenshots: these features are reported for historical versions, and it is not documented whether the ServiceWorker variant replicates or evolves them.

What to Do Now

Monitor Service Worker and SharedWorker activity in managed enterprise browsers, with particular attention to registrations from non-whitelisted domains combining fetch requests to multiple infrastructures.
Analyze download session behavior beyond transferred file hashes: detection must shift from the network/endpoint level to browser behavior during the assembly phase.
Verify that security tools in use assess the actual provenance of download components, not just the apparent domain presented in the download manager.
Review access policies for financial and trading sites: SourTrade's anti-researcher filters make preventive verification by threat intelligence teams particularly difficult.

The Lesson for the Security Industry

SourTrade signals a tactical shift that could influence the design of future security controls. When the browser ceases to be a mere viewer and becomes an execution environment with compilation and assembly capabilities, the defense perimeter inevitably shifts. The boundaries between legitimate and malicious code are no longer in the files crossing the network but in the processes occurring in memory, invisible to traditional inspection points.

The challenge for defense architects is not merely technical: it is epistemological. If every malware component appears legitimate in isolation — a Bun runtime, an API response, a Service Worker — detection must operate on sequence and context, no longer on individual substance. SourTrade demonstrates this leap is already operational in the field, not theoretical.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references