409/69 Monday, July 27, 2026
Security researchers from Confiant have released a report on a malvertising campaign called SourTrade, which primarily targets retail investors and cryptocurrency users in multiple countries. The campaign was initially reported to have been active since late 2024 and uses fake websites that impersonate well-known investment platforms such as TradingView, Solana, and Luno. What makes this threat notable is its advanced evasion technique. Instead of delivering a complete malware file over the network, the attackers force the victim’s web browser to assemble the components and create the malicious file locally, making it more difficult for traditional security systems to inspect and detect.
According to reported attack details, threat actors trick users into downloading software through impersonation domains. When a victim clicks an advertisement and visits the fake website, the system uses ServiceWorker-based commands to retrieve various components over the network, including the legitimate Bun runtime, a PE file structure, malicious code, and newly generated random data. The victim’s browser is then instructed to assemble all components and convert them into a Windows .exe
executable file. This technique causes the generated file to have a different hash each time it is downloaded, making hash-based detection ineffective because no complete malware file appears on the network during transmission.
To prevent and reduce risk, general users and investors should download trading or cryptocurrency wallet software only directly from the official websites of service providers. They should avoid clicking download links from sponsored advertisements. For network administrators and organizational cybersecurity teams, monitoring methods should not rely solely on file hash detection. Instead, teams should examine behavior across the full connection path, such as abnormal requests to backup domains or suspicious ServiceWorker activity. This can help improve the ability to detect and prevent threats using complex techniques of this kind in a timely manner.
Source: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html