SourTrade Malvertising Builds Unique Malware Inside Victims’ Browsers to Evade Detection

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Spread the love

SourTrade is a long-running malvertising operation that uses fake ads to lure cryptocurrency users toward convincing copies of trading and exchange platforms.

The campaign has been active since late 2024 and has targeted users across Asia-Pacific, Latin America, Africa, Australia, and Great Britain.

The attackers impersonate familiar brands, including TradingView, Solana, and Luno, then use visitor checks to keep researchers and automated systems away from the harmful content.

Confiant said in a report shared with Cyber Security News (CSN) that the people who do not meet the campaign’s targeting rules may only see a blank, harmless page.

The researchers found that SourTrade does not simply host a ready-made malicious file for victims to download. Instead, it makes the victim’s own browser assemble the final malware locally.

That approach makes the campaign harder to spot because security tools may see legitimate files, harmless code fragments, and ordinary-looking downloads rather than one clear malicious payload.

SourTrade Ad Brand Impersonation (Source – Confiant)

The activity also adds another risk for people who trust sponsored ads while searching for trading tools or crypto services.

SourTrade Malvertising

SourTrade’s landing pages prepare the download process before a victim clicks anything.

The pages register a ServiceWorker, a browser component that can control requests and downloads, then start a SharedWorker that receives instructions for constructing the final file.

Rather than sending an executable directly, the attackers provide a template, a clean Bun runtime, encrypted data, and session-specific values.

The browser combines those pieces in memory, creating a different Windows executable for each victim or session.

This method weakens traditional file-hash detection because a security product cannot easily match every newly created file to a known malicious sample.

It also complicates investigation, much like the techniques seen in browser cache malware attacks, where browser activity can become part of the delivery chain.

The final file is delivered through a same-origin browser download path controlled by the ServiceWorker.

To the user, the download can appear to come from the landing-page domain, while important parts of the build process originate from separate attacker-controlled infrastructure.

Ads, Cloaking, and Risk

The operation uses localized advertisements in English and the local languages of its selected regions.

Its fake pages imitate services used by retail traders, reaching people who may be searching for charts, blockchain projects, or ways to manage digital assets.

Researchers observed advertising and tracking logic associated with several large online advertising ecosystems on malicious pages.

This suggests the operators can measure traffic and refine their campaigns, a concern also reflected in recent Google Ads malware campaigns that steer users toward deceptive downloads.

Cloaking plays a central role in the campaign. SourTrade fingerprints visitors and gives suspected analysts, bots, or unwanted traffic a white page, while selected targets receive the fake platform page and its malware-building code.

Users should treat sponsored advertisements for financial tools with caution, especially when a page requests a software download.

Visiting services through saved bookmarks or manually typed addresses can reduce exposure to fake sites, while the broader malvertising threat landscape shows why ad-delivered threats remain a persistent security issue.

Organizations should examine browser downloads, advertisement referrals, ServiceWorker activity, and unusual connections to newly registered domains together rather than reviewing each signal separately.

Security teams should also block the indicators below where appropriate and investigate devices that interacted with them.

Indicators of compromise (IoCs):-

Type Indicator Description
SHA-256 19a29d26b94b708830c6eaea8a6c17616ec677adaf09114190d0e129564b2ca1b SourTrade malware hash
SHA-256 205c0d056a6b3e76736d4f378541d28f24ecdf40060eeed24d8aa283d2f0120f SourTrade malware hash
SHA-256 63ad542ed44df306bdcbb022ae210da74abad74e978cc1e3992016976282f31976 SourTrade malware hash
Domain noxani.info SourTrade domain IOC
Domain greensite.digital SourTrade domain IOC
Domain yuntaro.digital SourTrade domain IOC
Domain nexlisa.info SourTrade domain IOC
Domain vashiro.info SourTrade domain IOC
Domain campainter.digital SourTrade domain IOC
Domain riovera.info SourTrade domain IOC
Domain lunavo.club SourTrade domain IOC
Domain hanzoa.digital SourTrade domain IOC
Domain authcom.digital SourTrade domain IOC
Domain fererro.digital SourTrade domain IOC
Domain zythera.info SourTrade domain IOC
Domain angelxc.digital SourTrade domain IOC
Domain toushere.digital SourTrade domain IOC
Domain auronix.digital SourTrade domain IOC
Domain quorivamesh.digital SourTrade domain IOC
Domain junora.digital SourTrade domain IOC
Domain savanhe.digital SourTrade domain IOC
Domain tenderi.digital SourTrade domain IOC
Domain dexarionrte.info SourTrade domain IOC
Domain zuvex.digital SourTrade domain IOC
Domain minaro.club SourTrade domain IOC
Domain praxnova.info SourTrade domain IOC
Domain zuvex.club SourTrade domain IOC
Domain kalviorix.info SourTrade domain IOC
Domain thaivex.digital SourTrade domain IOC
Domain form-engine.digital SourTrade domain IOC
Domain solventa.club SourTrade domain IOC
Domain form-networktool.digital SourTrade domain IOC
Domain electmu.digital SourTrade domain IOC
Domain zenovapc.site SourTrade domain IOC
Domain qumoro.site SourTrade domain IOC
Domain insightcores.digital SourTrade domain IOC
Domain pulsewave-glow.digital SourTrade domain IOC
Domain ignite-spark.digital SourTrade domain IOC
Domain riberaz.com SourTrade domain IOC
Domain polvexa.site SourTrade domain IOC
Domain viewsafc.online SourTrade domain IOC
Domain insightmetrix.digital SourTrade domain IOC
Domain webnity.site SourTrade domain IOC
Domain cirevia1.digital SourTrade domain IOC
Domain tvviewreach.digital SourTrade domain IOC
Domain alteira.digital SourTrade domain IOC
Domain dalasu.digital SourTrade domain IOC
Domain parixaxj.com SourTrade domain IOC
Domain trustconnect.digital SourTrade domain IOC
Domain torvianet.site SourTrade domain IOC
Domain nebive.site SourTrade domain IOC
Domain forecastlogiccore.digital SourTrade domain IOC
Domain netkorava.digital SourTrade domain IOC
Domain forecasthub.digital SourTrade domain IOC
Domain dotlor.site SourTrade domain IOC
Domain koravaje.digital SourTrade domain IOC
Domain signalmetrics.digital SourTrade domain IOC
Domain forecastbridge.digital SourTrade domain IOC
Domain lakorava.digital SourTrade domain IOC
Domain pustou.site SourTrade domain IOC
Domain insightorbithub.digital SourTrade domain IOC
Domain dataroutehub.digital SourTrade domain IOC
Domain datasyncengine.digital SourTrade domain IOC
Domain forecastdeltaflow.digital SourTrade domain IOC
Domain forecastlogicflow.digital SourTrade domain IOC
Domain metricforge.digital SourTrade domain IOC
Domain forecastpulsegrid.digital SourTrade domain IOC
Domain robejj.com SourTrade domain IOC
Domain predictcore.digital SourTrade domain IOC
Domain dataplanehub.site SourTrade domain IOC
Domain oneclickme.site SourTrade domain IOC
Domain prolega.site SourTrade domain IOC
Domain nameprod.site SourTrade domain IOC
Domain transoe.site SourTrade domain IOC
Domain orientstrategypartners.digital SourTrade domain IOC
Domain beamoramag.digital SourTrade domain IOC
Domain beammaybea.digital SourTrade domain IOC
Domain urbanleafy.info SourTrade domain IOC
Domain brightmosaic.info SourTrade domain IOC
Domain forthlira.digital SourTrade domain IOC
Domain sobeamora.digital SourTrade domain IOC
Domain topbeamora.digital SourTrade domain IOC
Domain mortarora.digital SourTrade domain IOC
Domain lunarohub.info SourTrade domain IOC
Domain worldsol.site SourTrade domain IOC
Domain mindflowbase.info SourTrade domain IOC
Domain insight-radiant.digital SourTrade domain IOC
Domain nordexastudio.info SourTrade domain IOC
Domain cognitionpipeline.digital SourTrade domain IOC
Domain cognitionnodehub.digital SourTrade domain IOC
Domain acuitycore.digital SourTrade domain IOC
Domain radiantsynaptic.digital SourTrade domain IOC
Domain sapience-flare.digital SourTrade domain IOC
Domain engineclaritynode.digital SourTrade domain IOC
Domain flare-hub.digital SourTrade domain IOC
Domain beacon-net.digital SourTrade domain IOC
Domain brainyclevercore.digital SourTrade domain IOC
Domain syscodeapi.digital SourTrade domain IOC
Domain asiadataintelligencelab.digital SourTrade domain IOC

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.