A malvertising operation running since late 2024 has been assembling malware directly inside victims' browsers rather than transmitting finished malicious files, according to research published July 23, 2026, by Confiant and researcher Michael Steele. The campaign, tracked under the name SourTrade, impersonates the trading platform TradingView, the blockchain network Solana, and the cryptocurrency exchange Luno across 12 countries and 25 languages.

The research describes a delivery method that departs from how malvertising campaigns typically operate. Instead of hosting a completed executable somewhere on the network, the SourTrade landing page sends a victim's browser a set of assembly instructions. The browser then fetches separate components from different servers, generates additional random data locally, and stitches all of it together into a working Windows executable in memory, on the victim's own machine. According to the researchers, no finished malware file ever crosses the network as a single, intact object.

That distinction matters because it directly targets the most widely used defense in the industry. File fingerprinting, also called hash-based detection, works by calculating a unique digital signature for a known malicious file and blocking anything that matches. When each victim's browser builds a slightly different file using session-specific random values, every resulting executable carries a different hash. According to the report, this design defeats file fingerprinting by construction, since security tools scanning network traffic see only clean, unremarkable components passing back and forth.

How the assembly process works

The technical narrative Confiant lays out unfolds in four stages, and each one shifts a piece of the malicious work away from the network and onto the browser itself.

In the first stage, the money page, the version of the site shown to a genuine victim rather than to a bot or a researcher, registers a ServiceWorker. This is a browser feature that can intercept network requests and serve responses on the page's behalf, and it normally supports legitimate functions like offline caching. Alongside it, the page creates a SharedWorker built from JavaScript that is embedded directly inside the page's React code rather than fetched as a separate file. Building the worker from an in-memory blob, instead of loading it from a URL, means there is no separate worker file for a security scanner to inspect.

The second stage is where the campaign's central trick appears. The SharedWorker sends a request to an endpoint on the same page called /config. Rather than returning a file, that endpoint returns a JSON structure containing three things: a random seed and size value unique to that browsing session, a template array describing how to assemble the final file, and a URL pointing to a separate domain hosting a legitimate copy of the Bun JavaScript runtime. Bun is an open-source, publicly available tool used by developers to run JavaScript outside a browser; SourTrade repurposes it as the base executable that its own malicious code gets layered onto.

The third stage is the assembly itself. The browser downloads the clean Bun runtime named in the config response, generates a stream of pseudorandom bytes using the session's random seed through a cryptographic technique called AES-CTR, and then combines both of those with a set of base64-encoded data blocks that were embedded in the original config response. Those blocks contain the PE header and section table, the technical structure every Windows executable needs, along with what the researchers call the ".bun" section: the actual malicious bytecode that runs once the assembled file is executed. A class inside the page's code walks through the template array from left to right, copying bytes from each source into the correct position, the way a recipe specifies which ingredient goes in at which step. The result is a complete, working executable that never existed anywhere on the network as a single file, because every victim received their own instructions to build a version of it themselves, at the moment of infection.

In the fourth and final stage, the assembled file is handed back to the ServiceWorker registered in stage one, which serves it to the browser as a downloadable attachment from the site's own domain. From the victim's perspective, and from the perspective of most security logging, this looks identical to downloading a file directly from the landing page. The Mark of the Web signature, a Windows security feature that flags files downloaded from the internet, records the same-origin download URL rather than the separate domain that actually supplied the clean runtime and malicious code fragments. Reviewing any single piece of that chain in isolation, the researchers note, would miss how the whole mechanism functions together.

A campaign that has already changed its methods once

SourTrade is not presented as a brand-new discovery so much as a campaign whose internal machinery has shifted meaningfully since it was first documented. According to the report, cybersecurity firm Bitdefender published research in September 2025 describing a related TradingView-impersonating cluster titled "The Scam That Won't Quit: Malicious 'TradingView Premium' Ads Jump from Meta to Google and YouTube." That earlier version relied on a helper script called StreamSaver.js, hosted on GitHub, to manage its browser-side downloads. Confiant's own tracking through April 30, 2026, found SourTrade samples still pointing to that GitHub-hosted StreamSaver URL in their Mark of the Web artifacts. The current version, analyzed in this latest research, no longer depends on that external GitHub infrastructure, instead handling the same streaming download function through its own same-origin ServiceWorker code.

The report also contains a correction. An earlier version of the post had stated that Bitdefender's prior research referenced the use of Bun for staging the malware; Confiant corrected that claim, clarifying that Bitdefender's September 2025 analysis did not mention Bun specifically, even though the overall staging concept shows similarities.

The campaign's targeting spans a wide geographic range. According to the research, programmatic ads have appeared in Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Turkey, South Africa, Australia, and Great Britain, with the operation concentrating primarily on Asia-Pacific and Latin American markets while running ad copy in English alongside the local language of each targeted region.

Brand impersonation covers the retail trading lifecycle

The choice of brands to impersonate follows a deliberate logic, according to the researchers. By combining a charting and analysis tool (TradingView), a major layer-1 blockchain network (Solana), and a regional fiat-to-crypto exchange (Luno), the operation positions itself across three distinct moments in a retail trader's activity: researching markets, holding assets on a blockchain, and converting between currency and crypto. Three brand impersonations have been documented in the campaign to date.

To separate genuine victims from security researchers and automated bots, SourTrade's landing pages use what the industry calls a cloaking kit. These kits fingerprint an incoming visitor and decide, based on that fingerprint, whether to serve the malicious "money page" or a harmless "white page" that shows nothing suspicious at all. According to the researchers, this is why security teams investigating the campaign frequently see only a blank page, while an actual retail trader clicking the same ad sees a convincing replica of a trusted platform.

Evidence points to multiple advertising ecosystems

Perhaps the most consequential finding for the advertising industry concerns where these ads have actually been running. The research states that direct landing page evidence supports Bitdefender's earlier finding that the malvertising activity operates across both Google and Meta ecosystems. Confiant's own examination of the malicious pages found configuration and conversion logic for Google Ads, pixel calls and event beacons associated with Meta and Facebook, and pixel loading and event logic tied to Twitter and X. According to the report, this combination indicates the operators may be abusing all three platforms' advertising products simultaneously, tracking and optimizing which victims convert regardless of which network delivered the ad.

That detail places SourTrade inside a wider pattern that has drawn sustained scrutiny across the advertising industry over the past year. Meta has faced particular pressure over the scale of fraudulent advertising on its platforms. A Reuters investigation, examined in PPC Land's coverage of Meta charged suspected fraudsters premium rates while earning billions from scam ads, found the company's internal documents projected that roughly 10 percent of 2024 revenue, an estimated 16 billion dollars, would come from advertisements promoting scams and banned goods, alongside an estimated 15 billion higher-risk scam impressions served daily. Meta later disclosed removing 134 million scam ads in 2025, a figure PPC Land reported in Meta removes 134 million scam ads in 2025 amid expanding fraud crisis, and has since layered additional enforcement measures on top, including AI-powered cloaking detection announced when the company sued scam advertisers in Brazil, China and Vietnam over celeb-bait and cloaking.

The scale of the enforcement gap has itself become a data point in the industry debate. PPC Land reported this month that Facebook banned 3.5 billion fake accounts in 2025, according to VAB analysis, an amount equal to 43 percent of the global population, while noting that Meta's own strike system permits advertisers between 8 and 32 financial fraud violations before an account faces a ban. Legal pressure has followed the pattern of disclosures: a class action, covered by PPC Land in Consumer group sues Meta over scam ads that fund billions in revenue, drew directly on the Reuters documents to allege the company set enforcement thresholds tilted toward high-spending advertisers.

Expert commentary on the browser-as-assembly-point shift

Chris Olson, CEO of The Media Trust, a digital trust and safety company that has operated since 2005, characterized the technical shift underlying campaigns like SourTrade in a statement provided to PPC Land. "The attacker is no longer simply sending a malicious file through the advertising ecosystem. The browser is being used as the final assembly point, retrieving separate components and creating a unique payload on the user's device," Olson said. "That allows the campaign to appear benign during portions of the delivery chain and makes traditional file-based detection less effective. Protecting consumers requires continuous inspection of what the advertisement causes the browser to do, not only what the ad or landing page initially appears to contain."

The Media Trust describes its own detection infrastructure as built around continuous scrutiny of ad behavior rather than static file review. According to the company, its Media Scanner system draws on more than 1,000 geolocations across over 120 countries and evaluates more than 100,000 websites and applications alongside 10 million unique ad tags on a monthly basis, while its Media Filter product is designed to block or flag activity across more than 75 sensitive and regulated categories in real time. Those figures describe the company's general operating scale rather than any direct engagement with the SourTrade campaign specifically.

Why the detection challenge is structural, not incidental

The technical design Confiant documents creates several practical problems for anyone trying to catch the campaign through conventional means, according to the research. Each victim receives a differently assembled file, which limits how useful simple hash-based detection can be, since there is no single stable signature to add to a blocklist. The executable that shows up in a network log looks clean, because the actual malicious content only exists after the browser has finished its local assembly work; reviewing that downloaded file without accounting for what the browser did beforehand would produce a misleading result. And examining any one piece of the chain, the landing page, the config response, or the final download, in isolation risks missing how the mechanism functions as a connected whole.

The report also notes that this design gives the campaign's operators operational flexibility. Because the actual malicious payload lives inside the compiled JavaScript delivered through the config endpoint rather than in a static file sitting somewhere on a server, the operators can alter the payload on the fly without needing to change the overall delivery infrastructure that victims interact with.

Indicators of compromise

Confiant's published research includes a list of SHA256 hashes for malware samples associated with the campaign, alongside a domain list running to 96 entries used across SourTrade's advertising and hosting infrastructure. The domains span a mix of top-level extensions, heavily weighted toward .digital, .site, and .info, and cover both what appear to be brandable marketing-style names and infrastructure-sounding terms referencing forecasting, data routing, and analytics services, suggesting an effort to blend in among legitimate advertising and software-as-a-service domains rather than register obviously suspicious names.

What this means for the advertising industry

For programmatic advertising professionals, SourTrade illustrates a detection problem that sits upstream of any individual platform's scam-ad policies. A campaign that assembles its payload inside the browser, after an ad has already been approved and served, does not necessarily leave the same fingerprints that creative-review systems are built to catch. That gap has parallels elsewhere in the industry's fraud landscape. HUMAN's Satori team, in research PPC Land covered in HUMAN Security kills NewsJunkie CTV fraud scheme hitting 2 billion bids daily, has documented a comparable pattern of cat-and-mouse evolution, where fraud operators consistently adapt their infrastructure once a detection method becomes widely known.

The cross-platform evidence in the SourTrade research also reinforces a point PPC Land has tracked across separate investigations into Meta's advertising practices: fraud infrastructure that runs simultaneously across multiple ad networks does not respect the boundaries any single company's enforcement team operates within. Whether Google, Meta, or X individually catch and remove SourTrade's ads on their own platforms, the underlying browser-assembly technique documented in this research would remain available to the operators for use elsewhere, a dynamic that trade certification bodies like TAG have tried to address through cross-industry standards. PPC Land reported on TAG's certification program in TAG hands out 307 seals to 196 companies in 2026 recertification, which documented that unprotected advertising channels sustained an estimated 1.19 billion euros in fraud losses in 2023 alone.

Timeline

Summary

Who: Confiant and researcher Michael Steele authored the technical analysis. The campaign itself, tracked under the name SourTrade, impersonates TradingView, Solana, and Luno. Chris Olson, CEO of The Media Trust, provided expert commentary on the underlying technique.

What: SourTrade delivers malware by sending victims' browsers assembly instructions rather than a finished file, combining a legitimate Bun runtime, locally generated random bytes, and delivered malicious code fragments into a unique executable built in memory on each victim's device, a design that defeats hash-based file detection because no two assembled files share the same signature.

When: The campaign has run since late 2024. Confiant published its detailed technical research on July 23, 2026. Expert commentary on the technique's implications was provided to PPC Land on July 28, 2026.

Where: Programmatic ads tied to the campaign have appeared across 12 countries, including Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil, Nigeria, Turkey, South Africa, Australia, and Great Britain, with landing page evidence indicating activity across Google, Meta, and X advertising infrastructure.

Why: The campaign demonstrates a detection method that operates below the level most ad-platform scam policies are built to catch, since the malicious payload only comes into existence after an ad has already been served and a victim's browser has completed its own local assembly process, a gap that matters for any advertising platform relying primarily on file-based or hash-based scanning of ad creative and landing pages.