Cybersecurity researchers have uncovered two (2) highly sophisticated malware operations that are making detection much more difficult for traditional security tools. The first, known as SourTrade, uses fake cryptocurrency and trading websites that mimic trusted platforms such as Solana, Luno, and TradingView to lure victims into downloading malicious software. Instead of delivering a complete malware file, the attackers secretly assemble the malware inside the victim’s browser using advanced JavaScript and browser features, creating a unique version for each target and helping it evade signature-based defenses. Meanwhile, researchers identified Cruciferra, a powerful malware delivery service used in phishing attacks to deploy remote access trojans and information stealers across industries including finance, healthcare, government, education, and manufacturing. It uses advanced evasion techniques such as vulnerable drivers, privilege escalation, API unhooking, and memory-based execution to bypass security products and leave minimal forensic evidence. Together, these campaigns highlight a growing trend toward stealthier, highly customized malware that focuses on credential theft, financial fraud, long-term persistence, and security-tool evasion. CTIX analysts will continue to report on the latest malware strains and attack methodologies.