# SourTrade Is Handing Your Browser the Assembly Instructions
Serving a complete malicious executable from a single URL is increasingly a losing strategy. Antivirus engines catch it. Network proxies flag it. Threat intel feeds blacklist the domain before most victims even click. So the SourTrade campaign took a different approach: don't deliver the weapon fully assembled. Deliver the parts, and let the victim's own browser put them together.
That's the operational core of a campaign Confiant documented this week — a malvertising operation that has been running since late 2024, impersonating TradingView, Solana, and the Luno crypto exchange to pull retail traders into a staged payload delivery that ends with a Windows executable your system essentially built itself.
## The Build-It-Yourself Payload
Most malvertising works by pushing a victim toward a download page — click here, get malware. SourTrade inverts part of that model. Instead of serving a single recognizable binary, the campaign delivers the Windows executable in fragments, with the browser-side JavaScript responsible for reassembling the pieces into the final file before it's written to disk or executed.
The technique isn't entirely novel — researchers have seen fragmented payload delivery in exploit kit infrastructure before — but the refinement here is worth paying attention to. By splitting the malicious binary across multiple requests, no single network transaction contains the full executable. A network security tool scanning individual HTTP responses sees harmless chunks. A sandbox detonating a single captured request gets nothing actionable. The executable only materializes on the victim's machine after the browser has done its reconstruction work.
What makes SourTrade's implementation stand out is the choice of foundation: a legitimate Bun runtime binary. Bun is a relatively new but genuinely popular JavaScript runtime — real developers use it, real build pipelines reference it, and it shows up on clean machines in legitimate contexts. Using it as a base layer gives the campaign a plausible-looking footprint even after execution begins. Security tools that score binaries partly on origin reputation get handed a known-good runtime and have to figure out what happened next.
## Who They're Coming For
The target profile here is deliberate and financially motivated. TradingView is the dominant charting platform for retail traders across stocks and crypto. Solana is one of the highest-activity chains for DeFi and NFT activity. Luno is a crypto exchange with substantial user bases across Europe, Africa, and Southeast Asia. None of these were chosen randomly.
Retail crypto and stock traders represent a high-value, relatively soft target. They're actively searching for platform updates, new indicators, browser extensions, and desktop apps — exactly the kind of search behavior malvertising exploits. They often hold meaningful amounts in connected wallets or linked accounts. And unlike enterprise users, they're not operating behind layers of endpoint detection, SOC monitoring, or network filtering. Many are running consumer Windows machines with default AV, and they're used to downloading tools from wherever a search result or forum post points them.
Impersonating TradingView is a particularly sharp choice. The platform has no official mobile app for desktop trading, and its community regularly shares third-party tools, indicators, and scripts. A fake TradingView installer carrying a Bun-based payload is exactly the kind of thing a retail trader might download without much hesitation.
## The Evasion Architecture, Briefly
The broader evasion logic follows a pattern that's become more common since AV vendors got better at static binary analysis. If the final payload never transits the network as a unified object, signature-based detection has nothing to scan. If the reconstruction happens in JavaScript running in a browser context, behavioral heuristics aimed at traditional dropper patterns may miss it. And if the final binary is bootstrapped from a recognizable legitimate runtime, early-stage execution looks unremarkable.
This isn't a novel exploit chain — it's a logistics problem that someone thought carefully about. The campaign has been running since late 2024, which means it operated for roughly eighteen months before receiving detailed public documentation. That's a useful data point about detection difficulty.
## What Defenders Actually Need to Do
The honest answer is that most generic endpoint advice doesn't move the needle here. "Keep your AV updated" doesn't address a technique specifically designed to evade static signature scanning. A few things do matter:
DNS and network filtering with categorical blocking of malvertising infrastructure is more likely to catch this than endpoint tools. Confiant's documentation should feed into threat intel feeds quickly; organizations with real-time intel subscriptions should verify ingestion.
Browser isolation or script execution controls are underused in consumer and small-business contexts, which is exactly where SourTrade's targets live. Browser extensions like uBlock Origin in medium mode block script execution from non-whitelisted origins — not bulletproof, but meaningfully harder for this delivery chain.
Application allowlisting would catch the Bun runtime appearing somewhere it shouldn't. If your retail traders aren't running JavaScript runtimes as part of their normal workflow, a newly appeared Bun binary executing in a user directory is a detection opportunity.
Crypto users specifically should treat any "update available" notification or search-result-sourced download of a familiar platform with real suspicion — and should verify installer hashes against official sources before running anything.
## HackWire Analysis
SourTrade's browser-assembly technique represents something worth tracking as a trend, not just as an isolated campaign. The underlying logic — fragment the payload to evade network inspection, use legitimate tooling to confuse behavioral analysis — is likely to see adoption beyond this specific operation. Exploit kit authors and initial access brokers watch what works. A campaign that ran undetected from late 2024 through mid-2026 worked.
What's particularly notable is the intersection with the crypto and trading audience. This demographic has been hammered by social engineering, fake wallet apps, and seed phrase phishing for years — but technical payload delivery via malvertising against traders specifically is a somewhat underreported vector. The profile fits: active searchers, frequent software installers, high-value accounts, and minimal enterprise-grade controls. That's not going to stop being true.
The Bun runtime choice also signals attacker awareness of detection heuristics. Bun is new enough that many enterprise security tools haven't built robust behavioral baselines around it. Using an unfamiliar-but-legitimate runtime as a payload base is a way to stay ahead of tools that lean on "this binary is weird" signals. Expect to see other campaigns adopt similar approaches with other runtimes — Deno, Bun, and niche language runtimes are likely targets for this kind of abuse precisely because defenders have fewer established signals around them.
For threat hunters: look for Bun runtime binaries appearing in user temp directories, AppData, or Downloads folders on machines where no developer tooling is expected. A Bun process spawned from a browser process or a recently downloaded archive is a high-fidelity indicator. Confiant's full technical write-up should provide IOC sets worth operationalizing immediately.
The eighteen-month runtime before detailed public documentation is the number that should concern defenders most. Long-dwell malvertising that targets financially motivated retail users isn't going to slow down — it's going to keep refining.
— HackWire Editorial
---
## Related Coverage