A recent malvertising operation named SourTrade has been discovered using an innovative approach to distribute malware. Rather than delivering a complete malicious file, the operation instructs victims’ browsers to assemble the executable using a legitimate Bun runtime. This technique involves breaking down the malware into pieces, which are then put together by the browser itself, posing a new challenge for cybersecurity professionals.
Campaign Details and Target
According to Confiant, which reported on the operation on July 23, 2026, SourTrade has been active since late 2024. The campaign has targeted retail traders and cryptocurrency investors by impersonating well-known platforms such as TradingView, Solana, and Luno. It has been identified across 12 countries and is available in 25 languages, significantly expanding its reach.
The attack process starts with landing pages that differentiate between genuine users and potential threats like researchers and bots. Only selected targets receive a convincing imitation of the impersonated service. Confiant advises users to download trading and wallet software directly from official vendor websites instead of via ads to avoid such threats.
Technical Execution Without Browser Vulnerabilities
Interestingly, the SourTrade operation does not exploit any browser vulnerabilities nor does it remove the Mark of the Web (MotW). Instead, the attack involves a complex sequence of actions triggered by the landing page, which registers a page-scoped ServiceWorker and builds a SharedWorker using JavaScript embedded directly in the page.
The SharedWorker requests configuration data, which includes a template, secondary runtime URL, and session-specific random values. The browser then retrieves and decompresses a clean Bun runtime from a second domain, enabling the assembly of the final executable using Base64-encoded components.
Implications and Defensive Measures
The unique aspect of this attack is that each victim receives a differently assembled file, making traditional hash-based detection methods ineffective. As Michael Steele from Confiant notes, no complete malware binary exists on the network, which complicates detection and response efforts.
For cybersecurity defenders, it is crucial to analyze the entire attack chain, including the initial ad referral, cloaked landing pages, /config requests, and secondary-domain runtime fetches. Confiant has published several SHA-256 hashes and a list of malicious domains to assist in these efforts.
While the campaign’s current stage doesn’t allow for complete attribution, previous analyses by Bitdefender have linked similar operations to credential theft and other malicious activities. As cybersecurity experts continue to investigate, staying informed and vigilant remains essential for potential targets.
