Malvertising Campaign Uses Browser to Assemble Malware

A recently analyzed malvertising campaign named SourTrade is taking a novel approach to malware delivery. Instead of distributing a complete malicious file, the attack sends fragmented components to victims' browsers, which then reassemble them into a full Windows executable.

Security firm Confiant disclosed details of the campaign on July 23, 2026, revealing that it has been operating since late 2024. The attackers primarily targeted retail traders by impersonating well-known financial platforms such as TradingView, Solana, and Luno. This tactic increases the likelihood of user engagement and successful infection.

What makes SourTrade particularly insidious is its use of legitimate technologies. Rather than delivering a suspicious binary directly, the attack leverages the Bun JavaScript runtime environment, which is commonly used for web development. By doing so, it masks malicious behavior under the guise of trusted software.

How SourTrade Evades Detection

• The malware is split into multiple parts delivered via ad networks
• Victims' browsers are forced to reconstruct the payload using JavaScript
• Legitimate tools like Bun runtime are abused to execute final stages
• No single file contains the entire malicious code, complicating sandbox analysis

Impersonation Tactics and Targeting

• Impersonates popular trading platforms including TradingView, Solana, and Luno
• Designed to appeal to retail investors who frequently visit financial sites
• Leverages trust in known brands to increase click-through rates
• Operational since at least December 2024 according to Confiant's telemetry

Sources

• Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable