SourTrade: malvertising that assembles malware directly in the browser

Introduction

The “SourTrade” malvertising operation, active since late 2024, marks a leap forward in defense evasion: instead of delivering a ready-made malicious file, it tricks the victim’s browser into locally assembling a Windows executable. Targeting retail investors and cryptocurrency traders, the campaign impersonated well-known brands such as TradingView, Solana, and Luno, reaching 12 countries and supporting 25 languages. The analysis published by Confiant on July 23, 2026, shed light on the sophisticated attack chain, which creatively leverages ServiceWorker, SharedWorker, and the Bun JavaScript runtime.

Technical Analysis

The chain starts with malicious ads redirecting to a landing page that implements fingerprinting and cloaking: bots and researchers receive blank pages, while real browsers are served the malicious code. After profiling, the page retrieves from a /config endpoint a template, the domain for downloading the Bun runtime (e.g., purelogicbox[.]org), random values, and Base64-encoded PE sections. A ServiceWorker and a SharedWorker then generate a pseudo-random AES-CTR stream, combine the blocks according to the fetched template, and produce a unique binary for each session. The final executable—which blends the legitimate Bun runtime with malicious PE components and JavaScriptCore bytecode—is delivered via a hidden iframe with a Content-Disposition header.

This technique evolved from an earlier phase, traced back to April 30, 2026, when the download relied on the StreamSaver.js library hosted on GitHub Pages. The absence of exploits and the lack of Mark of the Web (MotW) removal techniques make the threat even stealthier, as it only abuses legitimate browser and Bun features. On July 26, 2026, Confiant corrected a previous statement: the September 2025 Bitdefender report on a related cluster does not mention Bun, so it remains unconfirmed whether current samples carry the JSCEAL/WeevilProxy payload (a stealer with keylogging, credential theft, traffic interception, and remote access). Confiant’s analysis stops at the download stage, so the full malicious capabilities of the binary are still to be verified.

Impact

The potential impact is high, consistent with the payloads documented by Bitdefender: credential theft, cryptocurrency wallet keys, keylogging, traffic interception, and remote access. Generating a unique per-session binary severely hinders hash-based detection, but the malicious components—the PE sections and bytecode—still traverse the network and can be intercepted by scrutinizing /config requests and the runtime download from suspicious domains. The campaign employs 96 malicious domains (shared as indicators of compromise) and operates in the sensitive arena of online investing.

Mitigation

For users: download wallets, trading platforms, and any financial software exclusively from official vendor websites, and avoid clicking on ads—even if they appear legitimate.

For defenders: monitoring the entire attack chain is critical—from the ad referrer, to the cloaking landing page, the /config request, the runtime download from suspicious domains, and the ServiceWorker activation. Confiant has released indicators of compromise (3 SHA-256 hashes and 96 domains) that should be integrated into detection systems. Moreover, inspecting traffic to malicious domains and analyzing the Base64 payloads in /config responses allows defenders to catch the components before assembly. There is no software patch, as the threat exploits no vulnerability but only standard browser and Bun features.

FAQ

What is the SourTrade campaign? It is a malvertising operation active since late 2024 that impersonates platforms like TradingView, Solana, and Luno to target cryptocurrency investors and traders. Unlike traditional campaigns, it does not push a pre-built malicious file; instead, it induces the victim’s browser to construct a Windows executable on the fly, combining a legitimate Bun runtime with malicious PE components and bytecode.

How does it create a unique executable for each victim? After fingerprinting, the landing page fetches from a /config endpoint a template, the Bun domain, random values, and Base64-encoded PE sections. A ServiceWorker and a SharedWorker use a pseudo-random AES-CTR stream to combine the blocks according to the template, generating a one-of-a-kind binary that is then downloaded via a hidden iframe.

What are the most effective countermeasures? Users should install financial software only from official sources and steer clear of ads. For defenders, it is essential to monitor the full chain (ad, cloaking, /config request, Bun download from suspicious domains) and deploy the IoCs provided by Confiant. Inspecting traffic to malicious domains and the Base64 payloads in /config responses can intercept the malicious components before they are assembled. There are no patches, since the technique relies on standard functionality rather than vulnerabilities.