# The Browser Is Now the Factory: How SourTrade Turned Your Chrome Tab Into a Malware Assembler
For a decade, the working assumption in endpoint security has been that malware arrives on disk — scanned, hashed, flagged, or blocked before it ever runs. A campaign targeting retail traders and crypto investors in 25 languages across 12 countries just quietly demolished that assumption.
The operation, which researchers at ad security firm Confiant have been tracking under the name SourTrade, doesn't deliver a finished malicious executable. It delivers *instructions*. The browser — your browser — builds the weapon itself.
## Assembly Required
The attack chain begins with fake landing pages impersonating Solana, Luno, and TradingView. These aren't crude look-alikes thrown together in an afternoon. They're functional enough to pass muster with impatient retail investors who found them via a sponsored search result or social media ad. A filtering layer quietly weeds out security researchers, automated scanners, and bots, redirecting them to blank pages. Only genuine targets — people who look like they actually trade — see the malicious content.
Once a real visitor lands, a ReactJS component initializes what Confiant's researchers call "a local assembly pipeline." Here's the sequence:
1. The page registers a service worker, which positions itself between the browser and any downloads
2. A SharedWorker spins up as the assembly engine
3. The page requests a /config endpoint that returns a *template* plus randomized seed and size parameters unique to that session
4. Remote components and locally-generated bytes are combined to reconstruct a clean Bun runtime executable, which is then corrupted into the final payload
5. The completed file is handed back to the service worker, which triggers a same-origin download — so the browser's mark-of-the-web tag shows the file came from the landing page itself
No complete malicious binary ever crosses the wire. At any given moment, only fragments exist in transit. The finished payload materializes exclusively in memory, assembled from parts that individually look benign.
## Why Every Hash-Based Defense Misses This
The hash rotation is the killer detail. By randomizing the seed and size parameters per session, every victim downloads a payload with a unique cryptographic fingerprint. Static detection — the backbone of most endpoint products and nearly all network-layer security tools — is structurally blind to this. You can't blocklist a hash that's never the same twice.
This isn't a minor evasion tweak. It's a deliberate architectural choice that turns file-hash reputation into dead weight. The threat actors clearly understood that the commodity defense layer they needed to defeat was signature-based, and they built the campaign specifically around that understanding.
Earlier variants of SourTrade used the open-source StreamSaver project from GitHub to handle the delivery mechanism. That dependency introduced a potential detection point — traffic to a known GitHub-hosted library. Since April 2026, the campaign migrated to same-origin ServiceWorker delivery, eliminating that external touchpoint entirely. The operation is actively maintained and improving.
## The Payload Does What You'd Expect — and Then Some
Confiant's researchers didn't publicly name the final payload, but they corroborated findings from a Bitdefender report tracking the same StreamSaver delivery infrastructure. Based on that analysis, what lands on victim machines is capable of:
For a retail trader who has their Coinbase credentials saved in Chrome and keeps a software wallet on the same machine, the blast radius of a single successful installation is total.
## Who's Actually Exposed
SourTrade is localized for 25 languages across 12 countries, with concentration in Asia-Pacific and Latin America. These are regions with fast-growing retail crypto participation and, historically, lighter adoption of enterprise-grade endpoint security tools. The targeting isn't random — the campaign's filtering actively identifies people who exhibit trading behavior before exposing them to the malicious page. This is precision malvertising, not spray-and-pray.
The attack surface is anyone who:
That's a very large population.
---
## HackWire Analysis
SourTrade is worth more attention than it's getting, because it marks a meaningful inflection point in malware delivery — not a minor variant on an old technique.
The security industry spent years building hash-based reputation systems, network signatures, and YARA rules premised on the idea that malware is a static artifact that moves across networks. SourTrade's in-browser assembly model isn't the first to push against that model, but the combination of hash randomization per session, same-origin service worker delivery, and a sophisticated filtering layer that defeats automated analysis is more operationally mature than previous efforts in this space.
What's missing from most coverage of this campaign is the implication for web application security. The attack weaponizes browser APIs — SharedWorkers, ServiceWorkers, ReactJS download flows — that every major browser ships and every legitimate web app uses. Blocking these at the browser level would break vast swaths of normal functionality. Defenders can't simply disable the attack surface without collateral damage.
The more actionable angle is what Confiant's analysis reveals about EDR blind spots. If the payload is assembled in memory and the download looks same-origin, many endpoint products will see a file emerging from a browser process with a valid mark-of-the-web tag and a hash they've never seen before. That combination is not reliably flagged as malicious. Security teams need to pressure-test their tooling against in-memory assembly scenarios — not assume that EDR catches what network scanning misses.
The financial sector should treat this as an active threat, not an emerging one. The campaign has been running since late 2024. If you manage security for a trading platform, crypto exchange, or fintech product with retail users in APAC or LATAM, your users are already in scope.
— HackWire Editorial
---
## Related Coverage