This malvertising campaign, active since late 2024, leverages fake cryptocurrency and trading websites that use JavaScript to assemble malware in the browser's memory. The attack registers service and shared workers to incrementally build a malicious executable from remote components and local assembly templates, resulting in a unique file hash per session to bypass static detection. The final executable is downloaded via a same-origin path, making detection more difficult. The campaign filters targets to focus on retail traders and crypto investors and operates in 12 countries with 25 languages, mainly in Asia Pacific and Latin America. Analysis links this campaign to the SourTrade operation, which previously used the StreamSaver project for payload delivery. The malware capabilities include network traffic interception, credential theft, keylogging, screenshot capture, cryptocurrency wallet theft, and persistence.

The malware can intercept all user network traffic, collect cookies and passwords, record keystrokes, take screenshots, steal cryptocurrency wallet data, and establish long-term persistence on infected systems. This poses significant risks to targeted retail traders and crypto investors, potentially leading to credential compromise, financial theft, and ongoing system compromise. The unique assembly method reduces detection likelihood and complicates forensic analysis.

No official patch or fix is applicable as this is a web-based malvertising campaign. Users should avoid downloading financial or cryptocurrency-related applications from social media ads or sponsored search results. It is recommended to obtain executable files only from official company websites and verify the digital signature and publisher before execution. Security teams should be aware of this delivery technique but no direct remediation is provided by vendors. Patch status is not yet confirmed — check vendor advisories for updates.