SourTrade Malvertising Campaign Secretly Builds Malware in the Browser

Confiant researchers detail SourTrade, a malvertising campaign active since 2024 that impersonates trading and crypto sites (e.g., TradingView, Solana, Luno) to lure victims and then uses JavaScript-delivered assembly instructions to fetch benign-seeming components and build an infostealer entirely in the browser memory, avoiding distribution of a complete malware binary on the network and evading file-fingerprinting defenses.