Antivirus software works by scanning files. It looks for known malicious code, flags suspicious downloads, and blocks threats before they can run. That model has protected millions of computers for decades.
A newly discovered attack campaign called SourTrade has found a way around it entirely — and the technique is unlike anything most people have seen before.
What Is Happening
Security researchers at Confiant published findings this week on a large-scale malware campaign that has been running since late 2024. The campaign operates through fake websites impersonating well-known financial and cryptocurrency platforms, including TradingView, Solana, and Luno. These sites are promoted through online ads and sponsored search results, drawing in people interested in trading and investing.
When a targeted visitor lands on one of these fake pages, something unusual happens. The site does not send a finished malware file to the user's computer. Instead, it uses the visitor's own web browser to assemble the malware from pieces, entirely inside the browser's memory, before handing the finished product to the user as what appears to be a normal download.
In plain terms: the attacker never transmits a complete malicious file over the internet. The browser builds it locally. By the time anything touches the user's device, it looks like a file that came from the website the user is currently visiting — and most security tools see nothing unusual at all.
Why This Is So Hard to Catch
Traditional security tools look for malicious files crossing the network. They scan what gets downloaded. They check digital signatures and known threat patterns. SourTrade is specifically designed to defeat all of those checks.
Because no finished malware file is ever transmitted, network-level scanning has nothing to catch. Because the malware is assembled fresh for each visitor using randomized components, it produces a unique file every single time, meaning signature-based detection tools cannot match it to a known threat. And because the final download appears to originate from the site the user is visiting rather than an external server, the browser's own security mechanisms treat it as a legitimate same-origin download.
The campaign also filters its victims carefully. Real users land on the malicious page. Security researchers, automated scanners, and bots get redirected to a blank page. The attackers have engineered this to be seen only by the people they want to target.
What the Malware Actually Does
Once installed, the payload is comprehensive and damaging. According to earlier research that linked to this campaign, the malware can intercept all network traffic on the infected machine, acting as a silent proxy between the user and every website they visit. It collects saved passwords and browser cookies. It records every keystroke the user types. It takes screenshots. It steals cryptocurrency wallet data. And it establishes long-term persistence on the device, meaning it survives restarts and continues operating in the background indefinitely.
For a business, a single infected device can expose every account the employee accesses, every password stored in that browser, and potentially the broader network if that machine is connected to company systems.
Who Is Being Targeted — and Why It Matters Beyond That Audience
The SourTrade campaign is primarily aimed at retail traders and cryptocurrency investors, which is why it impersonates platforms like TradingView. But the technique itself is not limited to finance. The same browser-assembly method can be adapted to impersonate any trusted platform and target any audience.
What matters for every business is the broader lesson: a file that appears to be a normal download from a website you intended to visit can now be malware assembled invisibly in your browser while you watched. The usual visual cues that something is wrong may not be there.
Where Businesses Are Most Exposed
Employees who use personal devices for work are a significant risk vector. Personal machines typically have fewer security controls, may not be managed through a centralized IT system, and are more likely to be used for personal browsing including financial and investment platforms.
Sponsored search results and social media ads are the primary delivery mechanism for this campaign. Anyone on your team who clicks ads in search results when looking for financial tools, investment platforms, or cryptocurrency resources could land on a fake page.
Browsers with stored passwords and saved sessions are the highest-value targets. The malware is specifically designed to harvest everything a browser has remembered, which on a work device can include company email, cloud platform logins, and remote access credentials.
What Your Team Should Do Right Now
Never download financial, investment, or cryptocurrency software by clicking a search ad or a sponsored result. Navigate directly to the official website by typing the address yourself or using a saved bookmark. This is the single most effective defense against this specific campaign.
Before running any downloaded installer, verify the file's digital signature. On Windows, right-click the file, select Properties, and check the Digital Signatures tab. The publisher name should match the company whose software you intended to download. If the signature is missing, invalid, or from an unfamiliar publisher, do not run it.
Remind your team that antivirus software catching a download is not the only signal that something is wrong. With techniques like browser-assembled malware, the absence of an antivirus alert does not mean a file is safe.
Keep browsers updated. Browser security teams actively work to close the mechanisms that attacks like this exploit. Current versions of major browsers have protections that older versions do not.
Consider using a DNS-level security filter on your business network. These tools block connections to known malicious domains before a page even loads, providing a layer of protection that operates before the browser ever encounters the malicious content.
And as always, use a password manager like Keeper rather than saving passwords in the browser. Browser-stored passwords are one of the primary targets of this malware. A dedicated password manager keeps credentials in an encrypted vault that is far harder for malware to harvest.
The Bottom Line
Malware no longer has to be delivered as a file. It can be assembled invisibly inside your browser while a page loads, using your own computer to build the threat before handing it to you as a download. Antivirus tools that watch for files crossing the network will not catch it. The usual warning signs may not appear. The defense is behavioral: only download software from official sources you navigate to yourself, verify what you are about to run, and treat every sponsored result as a potential risk.