Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A malvertising campaign dubbed SourTrade is employing a novel technique where victims' browsers build the final Windows executable themselves, using the legitimate Bun runtime as a base instead of serving a single malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, reported that the operation has been active since late 2024. The campaign impersonates TradingView, Solana, and Luno to target retail traders. By distributing malware in pieces and assembling it in the browser, the attackers evade traditional detection methods that rely on scanning complete files or known malicious URLs. The use of Bun, a legitimate runtime, further obfuscates the malicious activity. Confiant's analysis highlights the evolving sophistication of malvertising operations, which continue to adapt to bypass security measures.
Developers must be aware that browsers can be weaponized to assemble malware from legitimate components.