Rupert Marais is a leading specialist in device security and network management, known for his deep dives into how modern threat actors pivot from simple attachments to complex, browser-resident threats. He has spent years analyzing the intersection of web technologies and endpoint vulnerability, focusing on how attackers weaponize legitimate tools to bypass enterprise defenses. Today, he breaks down the “SourTrade” campaign, a sophisticated operation active since late 2024 that bypasses traditional security by turning the victim’s web browser into a malware manufacturing plant.
How do these modern campaigns manage to stay hidden from the very security researchers and automated bots designed to hunt them down?
The sophistication of this operation lies in its ruthless gatekeeping and selective visibility. By redirecting researchers, automated scanners, and security bots to a literal blank page, the attackers create a “ghost” infrastructure that is invisible to traditional detection. It is a chillingly effective filter that ensures only their specific prey—retail traders and crypto enthusiasts—see the malicious bait. This level of localization, which we have seen spanning 25 different languages across 12 countries, shows a massive investment in operational security that keeps their “success rate” high while staying almost entirely off the radar of global threat intelligence feeds. It creates a frustrating game of cat-and-mouse where the “cat” can’t even see the “mouse” unless they look exactly like the victim the mouse is waiting for.
The concept of a “local assembly pipeline” sounds like a significant evolution in web-based attacks; how exactly does a browser build its own malware?
This “local assembly pipeline” is a masterclass in deception that exploits the way modern browsers handle complex file transfers. Instead of a single, suspicious executable file crossing the network, the landing page uses a ReactJS library to orchestrate a multi-stage construction process directly in the browser’s memory. It starts by registering a service worker to act as a silent download manager, followed by a SharedWorker that functions as the actual engine. This engine then pulls in remote components and combines them with locally generated bytes to build the final payload using a clean version of the Bun executable. To the user, it feels like a standard, managed file transfer, but under the hood, the browser is being tricked into manufacturing its own poison, leaving very little for a network-based firewall to actually flag.
When it comes to traditional antivirus and EDR, why is the technique of rotating session parameters so effective at bypassing detection?
Traditional security often relies on static detection—basically looking for a known “fingerprint” or hash of a file—but this campaign completely breaks that model. During the assembly phase, the landing page requests a “/config” response that contains randomized seed and size parameters specific to that single session. By rotating these parameters for every single visitor, the threat actors ensure that the resulting malware file has a unique hash every time it is created. Because the browser itself is the one assembling the file from “clean” components, it even adds the “mark-of-the-web” tag, making the file look legitimate to the operating system. It is incredibly difficult for EDR tools to catch this because the “smoking gun” never actually travels over the network in a finished state; it only exists once it’s already sitting on the victim’s drive.
The scale of this operation seems incredibly focused yet geographically broad; what do we know about the regions and users being hit?
The SourTrade campaign is laser-focused on the Asia Pacific and Latin America regions, targeting users who are likely feeling the emotional high of the crypto market. By spoofing trusted platforms like Solana, Luno, and TradingView, the attackers tap into a sense of urgency and financial opportunity. We have seen the campaign localized into 25 languages across 12 countries, which suggests a very high level of coordination and cultural tailoring. These aren’t just generic phishing pages; they are carefully crafted mirrors of real financial tools designed to lure in retail traders through social media ads and sponsored search results. When you combine that geographical reach with the fact that security teams only alert on about 14% of successful attacks globally, you can see why this targeted approach is so dangerous for the average investor.
Once the malware is successfully assembled and executed on a victim’s machine, what is the extent of the damage it can actually do?
The payload is a multi-functional nightmare that effectively hands over total control of the victim’s digital life to the attacker. It has the capability to intercept all network traffic by acting as a proxy, which allows it to siphon off sensitive data before it’s even encrypted for the web. Beyond that, it functions as a comprehensive data thief, collecting cookies, saved passwords, and specifically targeting cryptocurrency wallet data. It doesn’t stop at passive theft, either; it includes keylogging and screenshot capabilities to capture real-time activity, while simultaneously establishing long-term persistence on the device. It is designed to be a “silent partner” on your machine, watching everything you do and waiting for the exact moment you access your high-value financial accounts.
What is your forecast for these types of browser-based assembly attacks?
I expect these browser-based assembly techniques to become the new standard for sophisticated malvertising because they are simply too effective to ignore. We have already seen this group evolve from using public GitHub projects like StreamSaver to developing their own custom same-origin ServiceWorker delivery methods since April. This shift shows that attackers are moving away from “off-the-shelf” tools that might be flagged and are instead building bespoke, stealthy delivery engines. As more users move their financial lives entirely into the browser, we will see even more localized, language-specific campaigns that exploit the “local assembly” loophole to bypass the 54% of attacks that usually get logged by enterprise security. The barrier between “visiting a site” and “infecting a computer” is becoming almost non-existent.
