Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A malvertising operation dubbed SourTrade is making victims’ browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and cryptocurrency investors across 12 countries in 25 languages. Its landing pages fingerprint visitors, showing suspected researchers and bots an empty page while selected targets receive a convincing copy of the impersonated service. The documented chain does not rely on a browser vulnerability or remove Mark of the Web (MotW). “No finished malware ever exists on the network,” wrote Michael Steele of Confiant’s threat intelligence team. Each victim can receive a different assembled file: rotating the seed and size in each /config response changes the hash while retaining the executable payload code.
The landing page begins preparing the delivery path without waiting for a download click. It registers a page-scoped ServiceWorker at /sw.js, then builds a SharedWorker from JavaScript already embedded in the page, so the worker source never appears as a separate fetch. The SharedWorker requests /config, which returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves and decompresses a clean Bun runtime from that second domain, purelogic[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS].org in the published sample response. Base64 blobs in the configuration supply the Portable Executable (PE) header, section table, and a .bun section containing malicious JavaScriptCore bytecode for app.js. Bun runs on Apple’s JavaScriptCore engine and legitimately supports compiling applications and bytecode into standalone Windows executables. The worker then generates a large pseudorandom byte stream using AES in counter mode (AES-CTR). It then follows the supplied template as a byte-copy recipe, combining selected ranges from the Bun runtime, the generated stream, and the attacker-controlled executable material. Once assembled, the page passes the executable to the ServiceWorker as a readable stream. A hidden iframe navigates to a same-origin URL, and the worker returns the generated bytes with a Content-Disposition attachment header.
The method evolved from activity Confiant tracked through April 30, 2026, when the pages loaded StreamSaver.js, an open-source streamed-download library, from its author’s GitHub Pages address. Bitdefender documented the related TradingView malvertising cluster in September 2025, identifying its final payload as the stealer Check Point tracks as JSCEAL and WithSecure as WeevilProxy. However, Confiant identifies shared campaign and executable characteristics but does not demonstrate that the three published samples carry that payload. There is no software patch to apply. Confiant notes that unique per-session builds limit the value of simple hash-based detections. Defenders should examine the whole chain, from the ad referral and cloaked landing page through the /config request, the secondary-domain runtime fetch, and the ServiceWorker download, rather than treating any single network or file artifact as decisive. Confiant published three SHA-256 hashes and a list of malicious domains, 96 by The Hacker News’ count. The firm named no actor and stopped its analysis at the moment the file lands on disk.