SourTrade malvertising is using counterfeit TradingView, Solana and Luno pages to make victims' web browsers assemble Windows malware in memory, according to research published by ad security company Confiant and reported by BleepingComputer on July 25. The operation targets retail traders and cryptocurrency investors in 12 countries and 25 languages, with most activity focused on the Asia-Pacific and Latin American regions.

Confiant said the campaign has operated since late 2024 and uses programmatic advertising plus cloaking to separate likely victims from researchers, scanners and security bots. Approved visitors see replicas of trusted financial platforms, while other traffic receives a blank page. Bitdefender Labs previously documented related fake TradingView promotions across Meta, Google and YouTube, along with hijacked advertising and video accounts.

The current delivery chain registers a ServiceWorker and creates a SharedWorker through JavaScript embedded in the landing page. A request to the page's config path returns a template, a clean Bun runtime location and randomized seed and size values instead of a complete malicious executable. The browser then combines the legitimate runtime, attacker-supplied blobs and locally generated AES-CTR bytes into a Windows portable executable.

Confiant found that the assembled file can vary by victim or session, reducing the value of static hash detection. The page hands the completed stream to the ServiceWorker and triggers a same-origin download, so network records do not contain the finished malware and the downloaded file records the landing-page domain in its Mark of the Web metadata. Confiant said the campaign replaced an earlier GitHub-hosted StreamSaver delivery method after April 2026.

The latest analysis did not identify the current final payload. Bitdefender's September 2025 investigation of the related cluster found malware capable of intercepting network traffic, collecting cookies and passwords, recording keystrokes and screenshots, stealing cryptocurrency wallet data and maintaining persistence. Confiant published three SHA-256 hashes and a list of campaign domains for defenders, while noting that per-session file changes limit hash-only controls.

Users should obtain trading and cryptocurrency applications from official vendor websites rather than advertisements or sponsored search results, BleepingComputer advised. Installers should be checked for an expected digital signature and publisher before execution. Security teams should examine the full browser, network and endpoint chain because reviewing individual clean components or relying solely on finished-file fingerprints may miss this delivery method.