Fake Solana and TradingView Sites Build Malware Inside Your Browser

Key points

• A malvertising campaign tracked as SourTrade has been running since late 2024, targeting retail traders and crypto investors in 12 countries across Asia Pacific and Latin America.
• Fake Solana, Luno and TradingView pages use JavaScript to assemble malware directly inside the visitor's browser, so no finished malicious file ever crosses the network.
• Ad-security firm Confiant says the operation switched from a GitHub-based delivery tool called StreamSaver to a service-worker method in April 2025.
• A 2025 Bitdefender report links the payload to malware that steals passwords, cookies, keystrokes, screenshots and cryptocurrency wallets.
• Download financial apps only from the vendor's official site and verify the installer's digital signature before running it.

A long-running ad scam is pushing fake versions of well-known trading and crypto sites, including Solana and TradingView. The malware isn't downloaded as a ready-made file. The victim's own browser builds it, piece by piece, in memory.

Ad-security company Confiant calls the operation SourTrade. Active since late 2024, it's translated into 25 languages and targets 12 countries, mostly in Asia Pacific and Latin America. BleepingComputer first reported the campaign.

The operators filter their traffic carefully. Real retail traders and crypto investors see the fake pages. Automated scanners and bots get blank pages instead.

How does the browser build malware on its own?

The fake site quietly turns the browser into a small factory. A script on the landing page pulls components together locally and hands the finished executable to the user as if it were a normal download.

The sequence, in plain terms: the page loads a ReactJS component that looks like a standard download button. Behind it, the page registers a service worker, a small background script browsers use to manage downloads and offline content. That worker acts as a download manager. A second background script, called a shared worker, then assembles the malware from parts. It asks itself for a "/config" response containing a template plus randomised seed and size values unique to each visit. Remote components are fetched and combined with locally generated bytes, then stitched onto a clean copy of the Bun JavaScript runtime to produce the final file.

Once built, the file is passed to the service worker and offered as a download from the same domain the visitor is already on. Windows tags it with the mark-of-the-web, a flag browsers attach to files downloaded from the internet, so it looks perfectly ordinary.

Why does this technique matter?

Because no complete malware file is ever sent over the network, tools that scan traffic for known bad files see nothing to block. Static antivirus signatures are also weakened: the randomised parameters mean every generated file has a different hash.

Confiant notes that earlier SourTrade waves used StreamSaver, an open-source GitHub project for saving large files in the browser. In April the operators moved to the same-origin service-worker method, which is stealthier and considerably harder to analyse. The browser-assembly trick fits a pattern we've been tracking: our 14 July story on fake GitHub pages impersonating 292 real brands showed a similar appetite for abusing legitimate browser behaviour to slip past defences.

What does the malware actually do?

Confiant didn't name the final payload but pointed to a 2025 Bitdefender report on a related campaign. That malware could sit as a proxy on all of a victim's internet traffic, steal cookies and saved passwords, log keystrokes, take screenshots, drain cryptocurrency wallets and keep itself running after reboot.

What should affected users do?

If you trade or hold crypto, treat sponsored search results and social-media ads for wallet or trading apps as suspect. Type the real service's address yourself, or use a bookmark you already trust.

Download installers only from the vendor's official domain. Before running one, right-click, check the digital signature, and confirm the publisher name matches the real company. If your machine has already run an installer from a sponsored link, change passwords from a clean device, revoke active sessions and move crypto to a fresh wallet with new keys.

Should you worry?

The honest answer is: yes, if you use trading apps and you've ever clicked an ad to get there. What's being undersold here isn't the technical cleverness of in-browser assembly; it's how ordinary the download looks when it arrives. The mark-of-the-web tag, the familiar brand page, the standard button: nothing flags it. Watch whether other campaigns adopt the same service-worker pattern, because right now most endpoint tools aren't built to catch it.