In-Browser Malware: How Malicious Sites Build Threats in Memory

The digital landscape is constantly evolving, and with it, the sophistication of cyber threats. A particularly insidious development is the rise of in-browser malware, where malicious code is assembled directly within the victim's web browser, bypassing traditional network and signature-based defenses. This article delves into the mechanics of such attacks, specifically focusing on the SourTrade campaign.

The Browser as a Local Assembly Plant

Since late 2024, the SourTrade malvertising campaign has targeted retail traders and crypto investors across 12 countries and 25 languages, primarily in Asia Pacific and Latin America. Attackers establish fake financial sites—mimicking platforms like Solana, Luno, or TradingView—to lure victims, ultimately deploying sophisticated in-browser malware.

The method deviates from traditional malware delivery. Instead of serving a pre-compiled binary, malicious JavaScript on these landing pages instructs the browser to construct the malware directly in memory. Confiant, which tracks this activity, accurately describes the browser as "a local assembly pipeline."

Deconstructing the In-Browser Malware Assembly Process

Let's break down how SourTrade bypasses standard defenses, showing a sophisticated approach to initial access and payload delivery:

1. Initial Access Evasion: Before reaching the malicious page, a filtering system redirects security researchers, scanners, or bots to a benign page. Only legitimate targets proceed to the active threat. This is a common technique, often leveraging IP reputation or user-agent analysis, as documented in various threat intelligence reports on malvertising campaigns.
2. Landing Page Setup: Upon arrival at a fake trading site, a ReactJS library starts controlling the download process. The static page becomes an active environment for payload preparation.
3. Worker Registration: The page registers two important browser components:
   • A Service Worker: This functions as a download manager, orchestrating the incremental assembly of the malware.
   • A Shared Worker: This component acts as the primary engine, responsible for compiling the malware from its constituent parts.
4. Configuration Request: The landing page uses the SharedWorker to request a '/config' response from the command-and-control server. This request incorporates randomized seed and size parameters, ensuring each session generates a unique configuration. This variability helps evade signature-based detection.
5. Template and Inputs: The '/config' response provides a template and necessary inputs for the browser to begin constructing a local file.
6. Malware Assembly: The SharedWorker combines remote components with locally generated bytes to create the malicious payload. This often starts with a clean version of the Bun executable, which then integrates the malicious modules, as detailed in recent analyses by Confiant. This approach allows the core executable to appear legitimate until fully assembled.
7. Same-Origin Delivery: Once the executable is complete, the Service Worker triggers a same-origin download. To the browser, this appears as a legitimate download originating from the landing page's domain, complete with the mark-of-the-web tag.

This method ensures no finished file is transmitted over the network. The randomized seed and size parameters result in a unique hash for every generated malware file, effectively bypassing static signature detection. Antivirus solutions relying solely on known hashes will fail to identify these payloads. Earlier SourTrade variants, observed before April 2026, utilized the StreamSaver project for delivery. Their shift to the stealthier same-origin ServiceWorker method shows how continuously they evolve their tactics, making the detection of this in-browser malware even more challenging.

What This Malware Actually Does

Payloads from earlier SourTrade variants, detailed in the 2025 Bitdefender report, exhibit capabilities typical of information stealers. But what makes them particularly effective is their delivery mechanism, which allows the deployment of sophisticated in-browser malware with a wide range of malicious functions:

• Network Traffic Interception: The malware can establish itself as a proxy, enabling full visibility and interception of network traffic (MITRE ATT&CK T1090.002). This allows attackers to monitor and manipulate all communications.
• Credential Theft: It targets browser cookies and stored password data (MITRE ATT&CK T1552.001). This includes sensitive login information for financial platforms and other online services.
• Keylogging: Every keystroke is recorded and exfiltrated (MITRE ATT&CK T1056.001). This captures everything from messages to passwords typed by the victim.
• Screenshots: Visual data of user activity is captured (MITRE ATT&CK T1113). This provides attackers with a visual record of the victim's desktop and interactions.
• Crypto Wallet Data Theft: This is a direct objective for their target demographic, involving the exfiltration of wallet files and private keys. Given the high value of cryptocurrency, this is a primary motivation for the SourTrade campaign.
• Persistence: Mechanisms are established to ensure continued access and execution across reboots (MITRE ATT&CK T1547). This ensures the in-browser malware remains active even after the user restarts their system.

For a retail trader or crypto investor in a targeted region, clicking a malvertising link can lead to comprehensive compromise of their digital financial assets. The localization across 25 languages shows a significant, targeted investment by the threat actors, indicating a well-resourced and determined adversary behind this in-browser malware campaign.

How We Push Back

The SourTrade campaign demonstrates a sophisticated evolution in malware delivery, leveraging browser capabilities to bypass traditional network and signature-based defenses. Countering such tactics requires a multi-layered, adaptive security posture that addresses each stage of the attack chain, especially when dealing with advanced in-browser malware.

Effective Content Security Policies (CSP) are critical for mitigating in-browser assembly. By precisely defining trusted sources for scripts and workers, organizations can prevent the malicious use of Service Workers and Shared Workers. Directives such as script-src 'self' combined with worker-src 'none' or explicit trusted origins would directly block the unauthorized registration and operation of these components, thereby disrupting the malware's assembly pipeline. Implementing a strict CSP is a proactive measure that can significantly reduce the attack surface for in-browser malware, ensuring that only approved scripts and resources are executed within the browser environment. Organizations should regularly review and update their CSPs to adapt to new threats and ensure comprehensive protection.

Initial access, often via malvertising, can be mitigated at the perimeter. Robust web filtering and ad-blockers serve as a foundational defense. By blocking known malicious ad networks and domains, these tools prevent users from ever reaching the fake trading sites that initiate the SourTrade attack, effectively neutralizing the primary infection vector before the in-browser assembly can commence. Advanced web filters can also leverage threat intelligence feeds to identify newly registered malicious domains or those exhibiting suspicious behavioral patterns, providing an additional layer of defense against the initial stages of in-browser malware delivery. Proactive blocking is always preferable to reactive detection.

Once a payload is assembled, Endpoint Detection and Response (EDR) solutions become paramount. Given that SourTrade generates unique malware hashes and assembles payloads in memory, static signature detection is insufficient. EDR systems must prioritize behavioral analysis, monitoring process execution, network connections, and interactions with sensitive data. For instance, an otherwise legitimate Bun executable attempting to access cryptocurrency wallet files or establish persistent network proxies should trigger immediate alerts, irrespective of its file hash. Modern EDR platforms, leveraging AI-driven behavioral models, are designed to detect such anomalies, providing real-time visibility and response capabilities against sophisticated in-browser malware that evades traditional antivirus. This behavioral approach is crucial for identifying threats that operate in memory or use legitimate tools for malicious purposes.

Finally, technical controls are complemented by informed user behavior. For high-value targets like crypto investors, user education remains a vital defense layer. Emphasizing skepticism towards unexpected download prompts, scrutinizing URL inconsistencies, and verifying site authenticity can prevent the initial compromise. The 2023 SEC advisory on phishing in the crypto space highlighted that social engineering remains a primary vector, even with advanced technical defenses in place. Regular training sessions, simulated phishing attacks, and clear guidelines on safe browsing practices can empower users to become the first line of defense against in-browser malware and other sophisticated cyber threats. A well-informed user base is an indispensable asset in the fight against evolving attack methodologies.

The SourTrade campaign shows how attackers continuously innovate, leveraging the browser's native capabilities for malware creation. Our defenses need to adapt to this reality. The browser is no longer merely a window to the internet; it functions as a potential workshop for threats, and we need to secure it accordingly. Understanding the mechanisms of in-browser malware is the first step towards building more resilient security architectures.