A new malvertising campaign, dubbed **SourTrade**, has been identified for its innovative approach to malware delivery. The operation is making victims' browsers construct the final Windows executable themselves, utilizing a legitimate **Bun** runtime as its foundation rather than serving a pre-built malicious file from a static URL. **Confiant**, which detailed the campaign on July 23, 2026, reports that **SourTrade** has been active since late 2024. It impersonates popular platforms like **TradingView**, **Solana**, and **Luno** to target retail traders and cryptocurrency investors across 12 countries in 25 languages.  ### Sophisticated Evasion Techniques **SourTrade**'s landing pages employ fingerprinting to distinguish genuine users from security researchers or bots. Suspected researchers are shown an empty page, while targeted individuals receive a convincing replica of the impersonated service. The primary defense remains consistent: always download trading and wallet software directly from the vendor's official website, not from advertisements. The documented attack chain does not exploit browser vulnerabilities or remove the **Mark of the Web (MotW)**. **Confiant**'s analysis focuses on the delivery mechanism, not the execution within the browser, and does not confirm whether the final download is automatic or requires user interaction. ### The Assembly Process The landing page initiates the delivery path without waiting for a download click. It registers a page-scoped **ServiceWorker** at `/sw.js` and then constructs a **SharedWorker** from JavaScript already embedded in the page, ensuring the worker's source is never fetched as a separate file. The **SharedWorker** requests `/config`, which provides a template, a secondary runtime URL, and session-specific random values. The browser then retrieves and decompresses a clean **Bun** runtime from this second domain (e.g., `purelogicbox[.]org` in the sample response). Base64 encoded blobs within the configuration supply the **Portable Executable (PE)** header, section table, and a `.bun` section containing malicious JavaScriptCore bytecode for `app.js`. **Bun**, which runs on **Apple's JavaScriptCore** engine, legitimately supports compiling applications and bytecode into standalone Windows executables. ### Unique Builds for Each Victim The worker then generates a large pseudorandom byte stream using **AES in counter mode (AES-CTR)**. Following the provided template, it combines selected ranges from the **Bun** runtime, the generated stream, and the attacker-controlled executable material. This process ensures that each victim receives a uniquely assembled file. Rotating the seed and size in each `/config` response changes the file's hash while preserving the executable payload. Michael Steele of **Confiant**'s threat intelligence team noted, "No finished malware ever exists on the network." While no complete binary is transmitted, the **PE** structures and bytecode are delivered as Base64 in `/config`.  Once assembled, the page passes the executable to the **ServiceWorker** as a readable stream. A hidden iframe navigates to a same-origin URL, and the worker returns the generated bytes with a `Content-Disposition` attachment header. The resulting **MotW** record identifies the landing page as the download source, not the secondary domain that provided the **Bun** runtime, thus **MotW** remains present. This method evolved from earlier activity **Confiant** tracked through April 30, 2026, where pages loaded **StreamSaver.js** from **GitHub Pages**. The current iteration maintains the streaming architecture but no longer fetches the library from **GitHub**, further obscuring the download path. ### Connections to Previous Campaigns **Bitdefender** previously documented a related **TradingView** malvertising cluster in September 2025, identifying its final payload as the stealer **Check Point** tracks as **JSCEAL** and **WithSecure** as **WeevilProxy**. **Confiant** identifies shared campaign and executable characteristics but does not definitively link the three published samples to the **JSCEAL/WeevilProxy** payload. The report also mentions that **Bitdefender** found a modified **Bun** executable within this cluster. However, **The Hacker News** found no mention of **Bun** in the September 2025 post **Confiant** referenced, which named its loader detection **Variant.DenoSnoop.Marte.1**. Therefore, credential theft, keylogging, traffic interception, wallet theft, and remote-access capabilities documented in the earlier campaign cannot yet be attributed to the current files. ### Defender Strategies There is no software patch for this evasion. **Confiant**'s practical implications section notes that unique per-session builds primarily limit the effectiveness of simple hash-based detections. Crucially, the attacker-controlled **PE** material and bytecode still traverse the network. Defenders should focus on examining the entire attack chain: from the ad referral and cloaked landing page, through the `/config` request, the secondary-domain runtime fetch, and the **ServiceWorker** download. Relying on a single network or file artifact for detection will be insufficient against **SourTrade**'s sophisticated methods. **Confiant** has published three **SHA-256** hashes and a list of 96 malicious domains. The firm did not name a specific actor and concluded its analysis at the point the file landed on disk.