The malware your browser builds for itself
For years the defence against a malicious download was a scanner watching what crossed the network: recognise the bad file, block it, move on. A malvertising campaign that ad-security firm Confiant detailed on 23 July quietly retires that model. There is no bad file to catch, because the finished malware never travels the network as a file. Your own browser builds it, in memory, from parts that each look harmless on their own.
How it works, without the jargon
The campaign, which Confiant calls SourTrade, runs through paid adverts impersonating well-known trading and cryptocurrency brands like TradingView, Solana, and Luno. It has been active since late 2024, spans 12 countries, and shows its convincing fake pages only to likely victims while showing researchers and automated scanners a blank one.
Here is the clever part. Instead of serving one complete malicious program from a fixed web address, the landing page hands the browser a recipe and a set of ingredients. Some pieces are pulled from a legitimate, clean software runtime. Others arrive scrambled inside the page's configuration. The browser is then instructed to follow the recipe and stitch the pieces together itself, assembling the finished Windows program in its own memory before offering it to the user as a download.
"No finished malware ever exists on the network," is how Confiant's Michael Steele put it. And because a random ingredient is mixed in fresh each time, every victim ends up with a slightly different final file. That defeats the oldest and cheapest defence there is: recognising a known-bad file by its fingerprint. There is no single fingerprint to recognise, because no two are the same.
Two things are worth keeping in proportion, and Confiant was honest about both. There is no software flaw being exploited here and no patch to apply: the browser is doing ordinary, permitted things, just chained together for a bad end. And Windows still marks the assembled file as downloaded from the internet, so the usual "this came from the web, are you sure" warning still fires. This is an evasion technique, not an invisibility cloak. But it is a good enough evasion that any defence resting only on spotting the download itself will miss it.
Why this belongs on your list
Most small businesses lean, knowingly or not, on exactly the defence this sidesteps. The browser's safe-browsing warnings, the antivirus that inspects downloads, the mail filter that blocks known-bad attachments: all of them work by recognising something they have seen before. A per-victim file that assembles itself in the browser is built specifically so there is nothing familiar to recognise.
The people most exposed are ordinary staff doing ordinary things. Someone searches for a tool, clicks the advert at the top rather than the real result below it, and lands on a page that looks exactly like the brand they wanted. The lure here is trading and wallet software, but the method travels, and the next campaign will wear a different costume. This sits alongside a pattern we have written about before, where the app you trust becomes the thing carrying the malware. The common thread: attackers have stopped needing a hole in your software and started borrowing the trust you already give to familiar names and normal downloads.
What to do this quarter
None of the fixes are exotic. They are the dull, cheap controls that keep working when the clever ones are being dodged.
Get software from the source, not the advert. The single most effective defence here costs nothing: install tools from the vendor's own website, typed in directly, never from an advert or a sponsored search result. Confiant's own advice comes down to this. Say it to staff as a plain rule, because the trick depends entirely on people trusting the ad at the top of the page.
Control who can install and run programs. If most staff cannot install arbitrary software on their work machines, a self-assembled program has nowhere to go once it lands. Day-to-day users should not be local administrators without a real reason, and steering people to a managed list of approved software removes the moment of choice this attack relies on. If you use an IT provider, ask them who can install what, and from where.
Do not lean on the download blocklist alone. The lesson underneath this campaign is that recognising known-bad files is necessary but no longer sufficient. Defences that watch behaviour, a program doing something unexpected once it runs, catch what fingerprint-matching misses. If your protection is a basic antivirus and nothing else, that is worth a conversation.
How Steelwise can help
Working out where your software comes from, who can install it, and whether your defences see behaviour or only known-bad files, is the kind of review we do without turning your team into a helpdesk queue. Get in touch.