The SourTrade malvertising campaign is a sophisticated operation targeting cryptocurrency users by redirecting them to deceptive versions of legitimate trading platforms. Initiated in late 2024, this campaign has expanded its reach to users across the Asia-Pacific, Latin America, Africa, Australia, and Great Britain. The attackers craftily imitate recognized brands such as TradingView, Solana, and Luno to lure unsuspecting victims.
Innovative Malware Assembly
Unlike traditional malware attacks, SourTrade does not distribute ready-made malicious files. Instead, it employs a novel tactic where the victim’s browser assembles the malware locally. This method complicates detection as security systems may only detect benign files and code snippets rather than a singular malicious entity.
The campaign’s landing pages initiate the download setup even before any interaction from the victim. By utilizing components like ServiceWorker and SharedWorker, the attackers efficiently manage requests and downloads. The malware is composed using a combination of a Bun runtime, encrypted data, and session-specific details, resulting in unique Windows executables for each session.
Challenges in Detection
Security solutions struggle to detect SourTrade’s malware due to its dynamic creation process. This approach undermines traditional file-hash detection since each file is distinct. The campaign’s use of browser-based assembly mirrors strategies seen in browser cache malware, where standard security measures fall short.
To victims, the download appears legitimate, originating from the landing-page domain. However, critical components of the malware originate from attacker-controlled infrastructure, heightening the risk for those trusting sponsored ads while seeking trading tools or services.
Security Implications and Recommendations
The use of cloaking techniques in the SourTrade campaign adds another layer of complexity, filtering out unwanted traffic and presenting malicious content only to targeted users. This method is similar to tactics seen in other malvertising campaigns, such as those involving Google Ads. Users are advised to be cautious with sponsored ads, especially those prompting software downloads.
Organizations should enhance their security measures by examining browser downloads, advertisement referrals, and unusual domain connections collectively. Blocking known indicators of compromise (IoCs) and investigating devices that interacted with them can help mitigate risks. Users are encouraged to access services through saved bookmarks or manually typed addresses to avoid fraudulent sites.
The persistent nature of ad-delivered threats underscores the importance of vigilance in the digital landscape. Security teams must stay informed and proactive to safeguard against evolving cyber threats.
