Malicious sites use JavaScript to build malware in browser memory

A large-scale malvertising campaign dubbed SourTrade has been active since late 2024, targeting retail traders and cryptocurrency investors through fake Solana, Luno, and TradingView webpages. The attack uses malicious JavaScript to assemble malware directly in browser memory, leveraging service workers and shared workers to build payloads locally with unique hashes per session to evade detection. The payload is believed to enable network traffic interception, credential theft, keylogging, screenshot capture, and cryptocurrency wallet theft, delivered without transmitting a complete file over the network.

AI-extracted · verify before operational use