Fake Solana and TradingView Sites Build Malware Inside Your Browser

Key points

• A malvertising campaign tracked as SourTrade has been running since late 2024, targeting retail traders and crypto investors in 12 countries across Asia Pacific and Latin America.
• Fake Solana, Luno and TradingView pages use JavaScript to assemble malware directly inside the visitor's browser, so no finished malicious file ever crosses the network.
• Ad-security firm Confiant says the operation switched from a GitHub-based delivery tool called StreamSaver to a service-worker method in April 2025.
• A 2025 Bitdefender report links the payload to malware that steals passwords, cookies, keystrokes, screenshots and cryptocurrency wallets.
• Users are advised to download financial apps only from the vendor's official site and check the installer's digital signature before running it.

A long-running online ad scam is pushing fake versions of well-known trading and crypto sites, including Solana, Luno and TradingView. The twist: the malware is not downloaded as a ready-made file. The victim's own browser builds it, piece by piece, in memory.

Ad-security company Confiant calls the operation SourTrade. It has been active since late 2024, is translated into 25 languages, and focuses on 12 countries, mostly in Asia Pacific and Latin America. The campaign was first reported by BleepingComputer.

The operators also filter their traffic. Real retail traders and crypto investors see the fake pages. Security researchers, automated scanners and bots get sent to blank pages instead.

How does the browser build malware on its own?

The fake site quietly turns the browser into a small factory. A script on the landing page pulls in ingredients, mixes them locally, and hands the finished executable to the user as if it were a normal download.

Here is the sequence, in plain terms. The page loads a ReactJS component that looks like a standard download button. Behind it, the page registers a service worker, a small background script browsers use to manage downloads and offline content. That worker acts as a download manager.

Next, the page sets up a shared worker, another background script, that assembles the malware from parts. It asks itself for a "/config" response containing a template plus randomised seed and size values unique to each visit. Remote components are fetched and combined with locally generated bytes, then stitched onto a clean copy of the Bun JavaScript runtime executable to produce the final malicious file.

Once built, the file is passed to the service worker and offered to the user as a download from the same domain they are already visiting. Windows tags it with the mark-of-the-web, a small flag browsers add to files downloaded from the internet, so the file looks perfectly ordinary.

Why does this technique matter?

Because no complete malware file is ever sent over the network, traditional defences that scan traffic for known bad files see nothing to block. Static antivirus signatures are also weakened, since the randomised parameters mean every generated file has a different hash.

Confiant notes that earlier SourTrade waves used StreamSaver, an open-source GitHub project for saving large files in the browser, to deliver the payload. In April the operators moved to the same-origin service-worker method, which is stealthier and harder to analyse.

What does the malware actually do?

Confiant did not name the final payload, but pointed to a 2025 Bitdefender report describing a related campaign. That malware could act as a proxy sitting on all of a victim's internet traffic, steal cookies and saved passwords, log keystrokes, take screenshots, drain cryptocurrency wallets, and keep itself running after reboot.

What should affected users do?

If you trade or hold crypto, treat sponsored search results and social-media ads for wallet or trading apps as suspect. Type the address of the real service yourself, or use a bookmark you trust.

Download installers only from the vendor's official domain. Before running one, right-click, check the digital signature, and confirm the publisher name matches the real company. If your machine has already run an installer from a sponsored link, change passwords from a clean device, revoke active sessions, and move crypto to a fresh wallet with new keys.