Malvertising Campaign SourTrade Uses Browser to Assemble Malware Executable from Pieces

A malvertising operation named SourTrade, active since late 2024, uses victims’ browsers to build a Windows executable from components served across multiple network requests, according to a July 23, 2026 report from Confiant. The campaign impersonates TradingView, Solana, and Luno to target retail traders and cryptocurrency investors across 12 countries in 25 languages.

The attack chain begins when a victim clicks a malicious ad. The landing page fingerprints visitors, showing researchers an empty page while selected targets receive a convincing copy of the impersonated service. The page registers a ServiceWorker and builds a SharedWorker from embedded JavaScript. The SharedWorker requests a /config endpoint that returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves a clean Bun runtime from a second domain (purelogicbox[.]org in the published sample). Base64 blobs in the configuration supply the Portable Executable (PE) header, section table, and a .bun section containing malicious JavaScriptCore bytecode.

The worker generates a pseudorandom byte stream using AES-CTR and follows the template as a byte-copy recipe, combining ranges from the Bun runtime, the generated stream, and attacker-controlled executable material. Each victim receives a differently hashed file while retaining the same payload code. The assembled executable is passed to the ServiceWorker as a readable stream, and a hidden iframe navigates to a same-origin URL, triggering a download with a Content-Disposition attachment header. The Mark of the Web (MotW) record identifies the landing page as the source.

Confiant notes that no complete malware binary ever exists on the network, though PE structures and bytecode arrive as Base64 in /config. The method evolved from earlier activity using StreamSaver.js from GitHub. Bitdefender documented a related TradingView malvertising cluster in September 2025, identifying the final payload as the stealer tracked as JSCEAL (Check Point) and WeevilProxy (WithSecure). Confiant shares campaign characteristics but does not confirm the same payload in the current samples. The Hacker News found no mention of Bun in the September 2025 post Confiant links to, which names its loader detection Variant.DenoSnoop.Marte.1. Confiant published three SHA-256 hashes and 96 malicious domains. No software patch is available; defenders should examine the full chain from ad referral through ServiceWorker download.