Researchers at Confiant have disclosed details of a malvertising campaign called SourTrade, in which the victim’s browser independently assembles the final Windows executable from the legitimate Bun runtime and malicious components delivered in parts. According to the researchers, the campaign has been active since late 2024 and targets retail traders and cryptocurrency investors in 12 countries, impersonating the TradingView, Solana and Luno brands. The finished malicious binary is never transmitted over the network as a whole — each victim receives a unique build with a different hash, making simple hash-based detection useless. To stay protected, the key recommendation remains the same: install trading platforms and wallet software only from the developers’ official websites, not via advertising links.
Mechanism for assembling the malware in the browser
The technical SourTrade delivery chain uses standard web platform capabilities without exploiting any browser vulnerabilities. The landing page begins its preparation even before the user clicks the download button: a ServiceWorker is registered at the path /sw.js, and then a SharedWorker is created from JavaScript code embedded directly into the page. As a result, the worker’s source code does not appear as a separate network request.
The SharedWorker contacts the /config endpoint, which returns a build template, the URL of a secondary domain for downloading the runtime, and per-session random values. The browser downloads and unpacks a clean Bun runtime from a separate domain — in the published sample this is purelogicbox[.]org. Bun is a legitimate JavaScript runtime based on Apple JavaScriptCore, which officially supports compiling applications and bytecode into standalone Windows executables.
The malicious components — the PE header, section table, and the .bun section with JavaScriptCore bytecode for app.js — are delivered as Base64 blobs in the /config response. The worker generates a pseudorandom byte stream using AES-CTR and, following the template “recipe”, combines fragments of the clean Bun runtime, the generated stream, and the malicious material into a single executable file.
Rotation of the initial seed value and size in each /config response changes the final file hash while preserving the functional malicious code. As Michael Steele from the Confiant team noted: “The finished malware never exists on the network” — although, as the analysis rightly clarifies, PE structures and bytecode do still traverse the network channel as part of the Base64 data.
Obfuscating delivery via ServiceWorker
The assembled file is passed to the ServiceWorker as a readable stream. A hidden iframe navigates to a URL on the same domain, and the worker returns the generated bytes with a Content-Disposition: attachment header. As a result, the Mark of the Web (MotW) entry identifies the landing page as the download source, rather than the separate domain from which the Bun runtime was obtained. At the same time, MotW itself is preserved — the delivery chain does not remove this protective marker.
An important caveat: the Confiant analysis documents the file delivery, but not its execution. The researchers did not determine whether the download starts automatically or requires user interaction. The analysis stops at the point where the file is written to disk.
The landing pages use visitor fingerprinting: presumed researchers and bots see a blank page, while selected targets are served a convincing copy of the impersonated service.
Evolution and links to previous campaigns
According to Confiant, the method evolved from earlier activity tracked up to 30 April 2026. In the previous version, the pages loaded the StreamSaver.js library from the author’s GitHub Pages, which left a download record path pointing to GitHub. The current version retains the streaming architecture, including the streamsaver: message names, but no longer contacts an external repository.
Bitdefender documented a related TradingView malvertising cluster in September 2025, identifying the final payload as a stealer that Check Point tracks under the name JSCEAL, and WithSecure as WeevilProxy. Confiant points to shared characteristics of the campaign and executables, but does not prove that the three published SourTrade samples carry the same payload. Capabilities documented in the earlier campaigns — credential theft, keylogging, traffic interception, cryptocurrency wallet theft, and remote access — cannot yet be definitively attributed to the current files.
It is worth noting a contradiction: the Bitdefender post from September 2025 cited by Confiant uses the detection name Variant.DenoSnoop.Marte.1 and, based on available information, does not mention Bun. This calls into question the accuracy of the linkage between the clusters and requires further confirmation.
Impact assessment
According to the researchers, the campaign spans 12 countries and uses 25 languages, indicating large-scale targeting of retail traders and crypto investors. Users who install trading software via advertising links in search engines and social networks are at the greatest risk.
The real impact of in-browser assembly techniques on defensive systems should be assessed realistically. Confiant formulates the practical implications cautiously: unique per-session builds reduce the effectiveness of simple hash-based detection. However, the malicious PE structures and bytecode are still transmitted over the network and remain available for network traffic analysis.
Defense recommendations
There is no software patch for this campaign — it does not exploit software vulnerabilities. Protection is built on several layers:
- For users: download trading platforms and crypto wallets only from official developer websites, ignoring advertising links
- For SOC teams: analyze the entire chain — from the ad click and cloaked landing page through the
/configrequest and runtime download from a secondary domain to streaming delivery via ServiceWorker — instead of looking for a single network or file artifact - For network defense: monitor requests to
/configendpoints that return Base64 blobs with PE structures, as well as the download and unpacking of the Bun runtime from unusual domains - For host-based detection: do not rely solely on hash signatures; use behavioral analysis of executables based on Bun with suspicious JavaScriptCore bytecode
- IOC: the domain purelogicbox[.]org has been recorded as the runtime source in the published sample. Confiant has published three SHA-256 hashes and a list of 96 malicious domains in the full report
SourTrade demonstrates a shift in attacker focus from delivering ready-made binaries to using standard browser APIs to assemble malware on the client side. The technique complicates hash-based detection but does not make the campaign invisible: the malicious components still pass through the network, and MotW is preserved on the downloaded file. The priority action for organizations is to add the IOCs from the Confiant report to monitoring systems and to configure detection of anomalous patterns: registration of a ServiceWorker followed by streaming delivery of an executable through a hidden iframe is a characteristic marker of this chain.
