Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A sophisticated malvertising campaign, dubbed SourTrade and linked to Confiant, is using legitimate browser technologies like Bun and a ServiceWorker to build Windows executables for victims, primarily targeting retail traders and cryptocurrency investors. The campaign operates since late 2024, impersonating TradingView, Solana, and Luno across 12 countries. Instead of delivering a complete malware file, the campaign constructs the executable within the browser, making traditional detection methods less effective due to unique, per-session builds.
A complex malvertising operation, spearheaded by Confiant, is leveraging browser functionality to deliver malware in a novel way. The campaign, known as SourTrade, began in late 2024 and has been targeting retail traders and cryptocurrency investors across 12 countries in 25 languages. The core of the attack involves impersonating popular services like TradingView, Solana, and Luno to lure victims into clicking malicious advertisements.
Instead of directly delivering a complete malware file, Confiant’s analysis reveals that the campaign constructs the final Windows executable entirely within the victim’s browser. The process begins with a landing page that fingerprints visitors and shows suspected researchers an empty page. The campaign then registers a page-scoped ServiceWorker at /sw.js, which builds a SharedWorker from JavaScript embedded in the page, effectively hiding the worker source code.
The SharedWorker requests /config, which returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves and decompresses a clean Bun runtime from the secondary domain, purelogicbox[.]org. Base64 blobs in the configuration supply the Portable Executable (PE) header, section table, and a .bun section containing malicious JavaScriptCore bytecode for app.js. Bun runs on Apple’s JavaScriptCore engine and legitimately supports compiling applications and bytecode into standalone Windows executables.
The worker then generates a large pseudorandom byte stream using AES in counter mode (AES-CTR). It then follows the supplied template as a byte-copy recipe, combining selected ranges from the Bun runtime, the generated stream, and the attacker-controlled executable material. Each victim receives a different assembled file, rotating the seed and size in each /config response to maintain a unique hash while preserving the executable payload code.
Confiant notes that no finished malware ever exists on the network, though the PE structures and the bytecode arrive as Base64 in /config. A hidden iframe navigates to a same-origin URL, and the worker returns the generated bytes with a Content-Disposition attachment header. The resulting MotW record identifies the landing page as the download source, not the separate domain that supplied the Bun runtime.
Bitdefender documented a related TradingView malvertising cluster in September 2025, identifying its final payload as the stealer Check Point tracks as JSCEAL and WithSecure as WeevilProxy. Confiant identifies shared campaign and executable characteristics but does not demonstrate that the three published samples carry the payload. The report also states Bitdefender found a modified Bun executable in this cluster.
There is no software patch to apply, as the evasion is more subtle than initially apparent. Confiant’s own practical-implications section suggests that unique per-session builds limit the value of simple hash-based detections, while the attacker-controlled PE material and bytecode still cross the network. Defenders should examine the entire chain, from the ad referral and cloaked landing page through the /config request, the secondary-domain runtime fetch, and the ServiceWorker download, rather than treating any single network or file artifact as decisive. Confiant published three SHA-256 hashes and a list of malicious domains, 96 by The Hacker News' count. The firm named no actor and stopped its analysis at the moment the file lands on disk.