SourTrade Malvertising Assembles Malware Inside Victim's Browser

A long-running malvertising campaign dubbed SourTrade is bypassing traditional detection by never delivering a complete malicious file over the network. Instead, the operation, documented by Confiant on July 23, 2026, pieces together a Windows executable inside the victim's own browser using a legitimate Bun runtime as scaffolding, then hands the assembled binary to the user as if it came from the original landing page. Active since late 2024, the campaign has impersonated TradingView, Solana, and Luno across 12 countries and 25 languages, fingerprinting visitors to filter out security researchers and bots before serving convincing replicas of the targeted platforms.

The delivery chain relies on no browser vulnerability and leaves the Mark of the Web (MotW) intact, because the ServiceWorker that returns the final file shares the same origin as the landing page. Once a target is approved, the page registers a ServiceWorker at /sw.js and spawns a SharedWorker whose source is embedded directly in the HTML, so it never appears as a discrete network request. The SharedWorker calls /config, which returns a template, a secondary runtime URL, and session-specific random values. The browser then fetches and decompresses a clean Bun runtime from that second domain (purelogicbox[.]org in the published sample), while Base64 blobs in the configuration supply the PE header, section table, and a .bun section containing malicious JavaScriptCore bytecode. Investigators tracking similar infrastructure can verify suspect domains with a WHOIS lookup.

To produce a unique file per victim, the worker generates a large pseudorandom byte stream using AES in counter mode, then follows the template as a byte-copy recipe, splicing ranges from the clean Bun runtime, the generated stream, and the attacker-supplied PE material. As Confiant's Michael Steele put it, "no finished malware ever exists on the network," though the PE structures and bytecode do arrive Base64-encoded inside /config. Once assembled, the page streams the executable to the ServiceWorker, and a hidden iframe navigates to a same-origin URL where the worker serves the bytes with a Content-Disposition: attachment header, making MotW attribute the download to the impersonated landing page rather than the secondary Bun runtime domain.

The defensive takeaway is unchanged but worth repeating: install trading and wallet software directly from the vendor's own site, never from an ad, and treat any in-browser download prompt on a financial brand's ad slot as hostile. Operators can also harden against fingerprinting and unwanted data exposure by running a browser fingerprint test and a DNS leak test to confirm their traffic is not leaking identifying details through alternate resolver paths. Confiant notes the campaign is still evolving, and its analysis covers delivery rather than what the resulting Bun-bundled bytecode executes once launched on the victim machine.