Malvertising campaigns continue to move away from obvious one-click malware downloads and toward delivery chains that look fragmented, temporary, and difficult to classify. A newly reported campaign called SourTrade is a strong example: instead of hosting one finished Windows executable at a stable URL, the operators make the victim’s browser assemble the final file from multiple parts during the session.
According to reporting on the campaign, SourTrade has been active since late 2024 and has impersonated brands familiar to retail traders and cryptocurrency users, including TradingView, Solana, and Luno. The goal is not simply to trick users with a fake page; it is to make the delivery path harder for defenders to reconstruct after the fact.
What makes this campaign different
The most important detail is not that the lure involves cryptocurrency or trading software. Those themes are common in malvertising. The notable technique is client-side construction of the executable.
The landing page uses browser features such as ServiceWorkers and SharedWorkers as part of the delivery workflow. A worker requests configuration data, retrieves a legitimate Bun runtime from another domain, and combines it with attacker-supplied Portable Executable structures and malicious bytecode. The browser then streams the completed Windows file back to the user as a download.
This matters because many security programs still lean heavily on finished-file indicators: a known download URL, a file hash, or a complete binary captured at a perimeter device. SourTrade is designed to make those indicators unstable. Each target can receive a different assembled file when the campaign rotates session-specific values, which changes the final hash while preserving the malicious logic.
This is evasion, not a browser exploit
Security teams should avoid overreading the technique. The reported chain does not require a browser vulnerability, and it does not prove that the browser executes malware by itself. The browser is being used as an assembly and delivery environment. The user still ends up with a Windows executable, and normal endpoint execution controls remain relevant.
The Mark of the Web is also reportedly still present. That means Windows and endpoint security tooling may still have useful context that the file came from the internet. However, the recorded source may point to the landing page rather than the secondary infrastructure that supplied part of the runtime, making investigation more complex.
The practical lesson is that defenders should not treat “no complete malware binary on the wire” as “nothing detectable.” The attacker-controlled PE material, configuration request, worker behavior, ad referral, fake brand page, and final download are all observable points in the chain.
Why Bun appears in the attack path
Bun is a legitimate JavaScript runtime and toolchain. In this campaign, attackers reportedly use a clean Bun runtime as a foundation and add malicious JavaScriptCore bytecode into the generated executable. That choice helps the campaign blend legitimate software components with hostile content.
This is part of a broader trend: attackers increasingly borrow trusted developer tooling, packaging formats, and runtime environments to reduce suspicion. The presence of a legitimate runtime does not make a file safe, and the presence of unfamiliar packaging should not automatically be dismissed as benign developer activity.
Defensive actions to prioritize
For organizations, the response should be layered rather than hash-only.
First, review web and DNS telemetry around malvertising referrals, newly registered lookalike domains, and landing pages that impersonate trading or wallet services. Pay special attention to users who arrive from sponsored search results or ad networks and then download Windows software from a page that is not the vendor’s official domain.
Second, inspect browser behavior where possible. ServiceWorker registration, worker-based streamed downloads, requests to /config, and cross-domain runtime retrieval can be useful signals when combined with suspicious referral and domain context. These events may be noisy in isolation, but they become meaningful when tied to a fake software landing page.
Third, strengthen endpoint controls for downloaded executables. Application control, reputation checks, sandbox detonation, and policies that warn on or block unsigned internet-delivered executables can reduce the chance that a user runs the assembled file. Because per-session hashes may differ, detection should include behavioral and structural rules, not only static hashes.
Fourth, educate high-risk users. Traders, finance staff, crypto users, and administrators should be reminded that ads are not a safe path to software downloads. The safest workflow is to type a known vendor domain directly, use a managed software portal, or follow links from a verified internal knowledge base.
Incident response checklist
If a user may have interacted with a SourTrade-style lure, collect more than the final file hash. Preserve browser history, download history, referrer information, DNS logs, proxy logs, the landing page URL, worker scripts where available, and endpoint telemetry around the downloaded executable. Look for adjacent credential theft, wallet access, browser data collection, or remote-access behavior, but avoid assuming a specific payload unless your evidence supports it.
Security teams should also hunt for repeated patterns: fake trading brands, configuration endpoints returning encoded executable components, use of secondary domains to fetch runtime material, and streamed downloads initiated through browser workers. These broader behaviors are more durable than any one hash from a per-session build.
Bottom line
SourTrade shows how commodity web features can be turned into an evasive malware delivery pipeline. The browser is not being “pwned” in the classic exploit sense; it is being used as a programmable assembly line. That distinction is important because it points defenders toward the right controls: trusted software sourcing, stronger download inspection, behavioral endpoint detections, and correlation across ad, web, DNS, and endpoint telemetry.
Source: The Hacker News source