THREAT REPORT - MALVERTISING

The fake TradingView ad that makes your own browser build the malware

Confiant calls the campaign SourTrade: fake TradingView, Solana and Luno ads on Google and Meta, with landing-page code pointing at X ads as well, cloned download pages in 25 languages across 12 countries, and a delivery trick in which no malware file ever crosses the network. The page ships clean parts and instructions, and the victim's own browser assembles the Windows executable in memory. Confiant published 96 campaign domains. Not one of them is the real thing.

SB

SafeBrowz Threat Research Security ResearchJuly 27, 202612 min read

You searched for the app. The ad was waiting.

Play the infection through from the victim's chair, because every step of it feels legitimate.

You trade. You want the TradingView desktop app, or a Luno app for your coins, or something from the Solana ecosystem. You search for it, or it finds you as a promoted post in your feed. The Confiant research published on July 23, 2026 places SourTrade's ads on Google and on Meta's platforms, and found the landing pages wired with X advertising code too, an indication the operation may run across all three. Between them that covers the search box and both feeds. The ad copy is unremarkable, which is the point. You click.

The page that opens is a working replica of the download page you expected: right logo, right screenshots, right typography, a Download button where a Download button should be. Confiant found the clones localized into 25 languages and aimed at 12 countries, among them Japan, South Korea, Taiwan, Hong Kong, Thailand, Brazil, Bolivia, Nigeria, Turkey, South Africa, Australia and Great Britain, and dates the operation's activity back to late 2024. That is not a smash-and-grab weekend campaign. That is a business with a localization budget.

You press Download. A file arrives, from the same site you are looking at, over HTTPS, and it opens like an installer. Nothing in that sequence gave you a reason to stop. The reasons all live one layer down.

The page starts building before you click anything

While you were reading the fake product page, its JavaScript was already setting up an assembly line.

First it registers a ServiceWorker, a small script at /sw.js that the browser allows to sit between the page and the network and answer requests on the site's behalf. ServiceWorkers are a normal, useful web feature: they are how legitimate sites work offline. Here the worker has one job, which it will perform at the end: serve the finished file as if it were an ordinary same-site download. The page pings it on an interval to keep it alive. Alongside it, a second worker built from embedded JavaScript acts as the assembly engine.

Then the page asks the site's /config endpoint for build instructions. What comes back is not malware. It is a recipe: a random seed and size unique to your session, a template describing how the pieces fit together, and the address of a helper component. As Confiant's Michael Steele put it, "No finished malware ever exists on the network." Anything watching your traffic at this moment, a corporate web gateway, an ISP filter, an antivirus network scanner, sees a trading site, a config file and, in the next step, a clean copy of a legitimate program.

Clean parts in, malware out

The clean program is Bun, a real, widely used JavaScript runtime. The page fetches an untampered copy of it, in the sample The Hacker News examined from a helper domain, purelogicbox[.]org. Then the assembly engine goes to work in your browser's memory: it expands the session seed into a pseudorandom byte stream using AES-CTR, follows the template to splice those bytes and the delivered components into the runtime, and produces a finished Windows executable that exists nowhere except inside your browser. The malicious logic rides as JavaScriptCore bytecode embedded in the Bun binary's own .bun section, so the file still looks like the legitimate runtime carrying its usual kind of cargo.

Because the seed is per-session, each victim receives a different file with a different hash. Confiant published three sample SHA256 hashes, and they are close to useless as a blocklist, which is precisely the design goal: hash-based detection assumes the same bad file reaches many people, and SourTrade makes sure it never does. The Hacker News, covering the research on July 25, notes that earlier related campaigns delivered the stealer family Check Point tracks as JSCEAL and WithSecure calls WeevilProxy, aimed squarely at crypto users, while being careful to say the three published samples have not been conclusively tied to that payload. Whatever the exact cargo, the targeting is not subtle: these are trading and wallet brands, shown to traders.

The last step is the quiet one. When the executable is ready, the ServiceWorker serves it to the save dialog as a same-origin download. Windows attaches its Mark of the Web, the provenance note that features like SmartScreen consult, and that note names the landing page as the source, not the helper domain that supplied the runtime. Earlier versions of the campaign leaned on a GitHub-hosted copy of StreamSaver.js for the same origin-laundering effect; the current version needs no outside help. Your machine's own records now say the file came from the site you chose to visit.

Go looking for the scam and it shows you a blank page

There is one more layer, and it explains why sites like this survive long enough to matter. SourTrade's pages sit behind a cloaking kit that fingerprints every visitor and sorts them: victims get the replica, while security crawlers, ad reviewers and researchers get a white page with nothing on it. Confiant, an ad-security firm, built its visibility into the ad chain itself, which is how it saw both faces.

Understand what that does to "I checked the site and it looked fine." Any check that depends on fetching and reading the page content, an ad platform's review bot, a sandbox, a curious analyst on a datacenter IP, can be fed the blank page. The site's content is a costume that is only worn for the audience. Which leads to the useful conclusion of this whole story: the signals that survive cloaking are the ones that exist before any page loads at all.

The tells that survive: read the address, not the page

Everything on the screen can be faked and, in this campaign, assembled on demand. What cannot be faked is the registrable domain in your address bar and its paper trail. The checks below need nothing else.

• The domain is not the brand's domain. TradingView lives at tradingview.com, Luno at luno.com, the Solana Foundation at solana.com. The campaign ran on names like noxani[.]info, tvviewreach[.]digital, lunavo[.]club and worldsol[.]site. Some gesture vaguely at the brand, most do not bother, because the ad and the page do the persuading. If the name in the bar is not the brand's own domain, nothing else on the page counts. Our guide to telling whether a website is a scam starts with exactly this habit.
• You arrived by ad, not by typing. An ad click is a redirect chain someone paid for. For anything you are about to install, and doubly so for anything that will touch money, close the tab and type the address. This is the same rule that beats search-engine phishing through paid ads in every variant we have covered, including the fake ChatGPT and Sora installer ads and the fake Claude Desktop campaign earlier this month.
• The TLD is wrong for the brand. Of the 96 domains Confiant published, 93 sit on cheap alternative endings: .digital, .site, .info, .club or .online. Only three are .com. No major trading platform distributes its desktop app from a .digital or .club address.
• The domain was born weeks or months ago. We pulled registration records for a sample of the list: noxani[.]info was registered June 10, 2026 and greensite[.]digital June 11, 2026; worldsol[.]site and riberaz[.]com in March 2026. TradingView's domain has held its reputation for well over a decade. Registration age is public, free to check, and impossible for a throwaway domain to counterfeit.

What the 96 published domains have in common

Confiant's indicator list is worth reading as a dataset, not just as a blocklist, because it shows what an industrialized malvertising operation buys when it needs a hundred doorways.

By our count of the published list, 61 of the 96 domains end in .digital, 14 in .site, 13 in .info, 4 in .club, 1 in .online and 3 in .com. The names split into two styles. One is word salad that sounds faintly like a SaaS product: forecastpulsegrid[.]digital, datasyncengine[.]digital, cognitionpipeline[.]digital. The other is short invented brands: zuvex[.]digital, minaro[.]club, qumoro[.]site. Almost none of them lean on the impersonated brand's name, which tells you the operators expect the ad creative and the cloned page to carry the deception, and the domain to be disposable.

Disposable is the operative word. These are bulk-purchase TLDs chosen for price, registered in recent weeks or months, with no history behind them. And that profile is the campaign's structural weakness: it is visible from the outside, before the page loads, and no amount of in-browser cleverness can hide it. A cloaking kit can decide what content to show a visitor. It cannot make a domain older, move it to a reputable TLD, or give it a history it does not have.

The one thing SourTrade cannot assemble is a trustworthy domain

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. Here is honestly where each layer stands against this campaign, because a threat built to defeat file scanning deserves a straight answer about what a browser layer can and cannot do.

• Layer 1, Local detection: URL-shape checks run in the extension before the page renders: 60+ URL patterns, no-HTTPS and raw-IP checks, homograph detection. SourTrade's plain word-salad hostnames are deliberately bland, so for this campaign the local layer is mostly a tripwire; the decisive signals come from the next layer's lookups.
• Layer 2, API checks: the domain is cross-referenced server-side against our 550+ brand database, Google Safe Browsing, PhishTank, URLhaus and ScamAdviser feeds, our own indicator blocklist, which absorbs published research like Confiant's domain list, and a 30+ scam TLD watchlist. That watchlist already covers .digital, .site and .online, which between them account for 76 of the campaign's 96 domains, and the scan surfaces registration age, which for these hosts is measured in weeks or months. None of these signals needs the page to render, which is exactly the property that matters against a cloaked site: the white page shown to scanners changes nothing about what the domain is.
• Layer 3, AI deep scan (Premium): AI content analysis via our proxy reads the page like an analyst and catches a brand-cloned download page on a no-name domain in any of the 100+ languages the AI scan reads, including all 25 this campaign localizes into. The honest caveat: SourTrade's cloak can serve an automated fetch the same blank page it serves researchers, so on this campaign the content layer is the backup, not the star. The verdict leans on the domain evidence above, which needs no page at all.

And the hard limit, stated plainly: everything a browser layer can do happens before the save dialog. If the assembled executable has already been saved and run, no extension can un-run it. From that moment this is an endpoint and incident-response problem, and the section below is the honest next step. What the browser layer buys you is the moment that mattered here, the landing on a weeks-old .digital domain dressed as TradingView, before its JavaScript starts building anything.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

If you already ran a file from one of these sites

Treat it as a live compromise of everything that machine touches, with your crypto first in line. The order matters.

• Disconnect the machine from the network and leave it off. If it is a work device, hand it to your security team as-is and stop here.
• Switch to a clean device for every step that follows. Changing passwords on the infected machine hands the new ones over too.
• Move crypto immediately. This campaign targets traders, so assume wallet data was the point. Create a fresh wallet on a clean device, ideally hardware-backed, and transfer funds out. Any seed phrase that was ever typed, stored or screenshotted on the infected machine is burned.
• Change passwords, then revoke every active session, starting with your email and your exchange accounts. Stolen session cookies keep working after a password change, so use each service's "sign out everywhere" control.
• Rebuild the operating system. A payload assembled uniquely for your machine is not something to hunt file-by-file. A full reinstall is the answer you can trust.
• Report it: in the US, the FBI's Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov. Our guide to the first 24 hours after a scam walks the full lockdown order.

Frequently asked questions

What is the SourTrade campaign?

SourTrade is the name Confiant gave to a malvertising operation it documented on July 23, 2026. The operators buy ads on Google and Meta that impersonate TradingView, Solana and Luno, with landing-page tracking code indicating X advertising as well, and point them at cloned download sites localized into 25 languages across 12 countries. Instead of serving a malware file, the sites deliver a clean Bun runtime plus assembly instructions, and JavaScript builds a unique Windows executable inside each victim's browser, served through a ServiceWorker so the download appears to come from the page itself. Confiant says the operation has been active since late 2024 and published 96 campaign domains plus three sample file hashes.

Was TradingView, Luno or Solana hacked?

No. None of the three brands was breached, and their real sites and apps are unaffected. The campaign impersonates them because they are what its targets, retail traders and crypto investors, search for. The genuine sites are tradingview.com, luno.com and solana.com. The malicious pages live entirely on attacker-registered lookalike infrastructure such as noxani[.]info and greensite[.]digital, none of which the brands control.

Why did my antivirus not flag the download?

Three reasons, all by design. First, each victim's file is assembled from a per-session seed, so every copy has a different hash and hash-based detection never sees the same file twice. Second, the components that cross the network are individually clean: a legitimate Bun runtime and configuration data, so network scanners have nothing to match. Third, the ServiceWorker serves the file same-origin, so Windows' Mark of the Web records the visited page as the source, which weakens reputation checks on the download. A clean scan of this particular file means very little. If you ran an installer from one of these sites, treat the machine as compromised regardless of what a scan says.

I installed a trading app from an ad. What should I do now?

Assume compromise and act in this order: disconnect the machine from the network; move to a clean device; transfer any crypto to a fresh wallet created on that clean device, because wallet theft is this campaign's target profile; change passwords and revoke all active sessions, starting with email and exchanges, since stolen cookies survive password changes; then rebuild the operating system rather than trying to delete files. Report the incident at ic3.gov and reportfraud.ftc.gov if you are in the US. If it is a work machine, tell your security team first and touch nothing.

How do I download the real TradingView app safely?

Type tradingview.com into the address bar yourself and use its desktop page at tradingview.com/desktop; get the mobile apps from the official Apple App Store or Google Play listings linked there. The same habit covers any trading or wallet app: type the official domain, never install from a sponsored search result, a feed ad or a promoted post, and be suspicious of any "app" offered from a domain ending in .digital, .site, .info or .club. A typed address costs five seconds and defeats the entire ad-side of this campaign.

Last updated 2026-07-27