Cybercriminals are refining malvertising campaigns to evade traditional detection methods, with the latest SourTrade operation assembling malware inside victims’ browsers before deploying an infostealer.

The approach highlights how attackers are adapting delivery techniques to bypass security controls while continuing to exploit interest in cryptocurrency and online trading.

Commenting, Darren Guccione, CEO and Co-Founder at Keeper Security had the following to say: 

“SourTrade’s real innovation isn’t the lure, it’s the build process. By shipping instructions rather than a finished binary, and assembling the payload inside a legitimate runtime already resident in the browser, the operators sidestep the checks most organisations still lean on, including hash matching, static signatures and network-level file inspection. Nothing suspicious crosses the wire until it’s already running on the endpoint, and even then it looks slightly different on every machine.

“Detection built around file recognition will always lag behind attackers who can alter what that file looks like. Organisations need to shift their focus toward what an unknown executable is allowed to do rather than what it resembles. Least-privilege endpoint controls that block unsigned or unrecognised binaries from writing to sensitive paths, elevating privileges or reaching credential stores would blunt this technique regardless of how the payload was assembled.

“This is a credential harvesting operation aimed at traders and crypto holders. Session tokens, wallet credentials and exchange logins are the actual target, which makes privileged access and credential vaulting, not just endpoint hygiene, the second half of the defence. Organisations that vault credentials and enforce session controls at the identity layer have a second line of defence that holds even when the endpoint has already been reached.”