The SourTrade malvertising operation targets cryptocurrency investors by using a legitimate Bun runtime to dynamically assemble malicious Windows executables directly within a victim's browser during the download process.

Key Points

• Security firm Confiant identified the SourTrade campaign, which has been active since late 2024 and impersonates brands like TradingView, Solana, and Luno.
• The operation targets retail traders across 12 countries by using browser-based ServiceWorkers to build unique, per-session executable files.
• By assembling the final binary on the victim's machine, attackers bypass traditional hash-based detection methods used by security software.
• The malicious process utilizes a legitimate Bun runtime to compile JavaScriptCore bytecode into standalone Windows executables without hosting a complete malicious file on a server.
• Confiant documented 96 malicious domains associated with the campaign, which uses sophisticated cloaking to hide landing pages from security researchers and automated bots.

Why it Matters

This technique represents a significant evolution in malware delivery by shifting the burden of file assembly from the attacker's server to the victim's browser. Because each downloaded file is unique, traditional signature-based security tools struggle to identify and block these threats effectively.