SourTrade legacy MotW spoofing via GitHub-hosted StreamSaver.js path

Duo Tech@duotech

•updated Jul 27, 2026•2•0•6

Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.