Breaking Lab srl
A New Kind of Malvertising: Assembly Required
Security researchers have documented a malvertising campaign that takes a strikingly novel approach to evading detection: rather than delivering a complete malicious executable from a remote server, the operation instructs victims’ browsers to build the final malware themselves, piece by piece, entirely within system memory. The campaign, dubbed SourTrade by threat intelligence firm Confiant, was publicly detailed on July 23, 2026, though evidence suggests it has been operating in the wild since at least late 2024.
The technique represents a meaningful evolution in how attackers think about payload delivery. Conventional anti-malware tooling is highly tuned to detect the arrival of a complete malicious file — whether downloaded from a server, dropped to disk, or transferred over a network. SourTrade sidesteps that detection surface almost entirely by distributing the pieces of the executable across multiple channels and letting the browser itself perform the final assembly step, never writing a traditional suspicious file to disk until the very last moment, if at all.
Impersonating Trusted Trading Platforms
The social engineering layer of the campaign is equally calculated. SourTrade has masqueraded as well-known platforms in the retail trading and cryptocurrency space, including TradingView, Solana, and Luno — all names that carry genuine credibility with the financially motivated audience the attackers are targeting. Victims arriving at these convincing lookalike pages are presented with what appears to be a software download or a browser extension update, prompting them to interact with content that silently triggers the in-browser assembly process.
What makes the campaign particularly difficult to combat at the network level is its use of a legitimate runtime environment as the foundation. SourTrade uses Bun, a fast and increasingly popular JavaScript runtime, as its base layer. Because Bun is a legitimate, widely used development tool, its presence on a system raises far fewer automated alarms than a purpose-built malicious loader would. Attackers are essentially hiding inside a trusted tool’s identity.
How the In-Browser Build Process Works
Rather than hosting one monolithic malicious binary at a fixed URL — an approach that makes takedowns relatively straightforward — SourTrade delivers fragmented components through malicious JavaScript embedded in rogue advertising inventory. The browser fetches these components from separate locations, the JavaScript logic stitches them together, and a Windows executable takes shape in memory. The final payload is then executed, giving attackers a foothold on the victim’s machine without a conventional download-and-run chain that security software would typically catch.
This approach also complicates threat intelligence efforts. Because no single URL hosts the complete payload, blocklists and URL reputation services face a much harder task. The components in isolation may appear benign, and the assembly logic itself can be obfuscated within otherwise ordinary-looking ad scripts.
Retail Traders in the Crosshairs
The targeting of retail traders and cryptocurrency users is deliberate. These communities frequently download charting tools, trading terminals, and wallet software from the open web, often without the enterprise-grade endpoint protection that corporate environments deploy. They are also likely to be operating on personal machines where patching and security monitoring may be inconsistent. The financial motivation of the targets also suggests attackers are looking for credential theft, crypto wallet access, or the deployment of further-stage banking malware.
What This Means for Browser and Endpoint Security
The SourTrade campaign is a pointed reminder that the browser has become the most consequential attack surface on a modern endpoint. As more of daily computing — including high-value financial activity — moves into the browser, adversaries are investing seriously in browser-native attack chains. The industry’s traditional reliance on file-hash detection and URL blocklisting looks increasingly insufficient against campaigns engineered from the ground up to avoid generating the artifacts those defenses look for. Defenders will need to lean harder on behavioral analysis — watching what code actually does in memory rather than what it looks like on arrival — and browser vendors may face growing pressure to restrict the kinds of dynamic code execution that make campaigns like this possible in the first place.
