Malvertising Campaign 'SourTrade' Assembles Malware Client-Side to Dodge Detection

What Happened

Security firm Confiant disclosed on July 23, 2026, a malvertising campaign it has dubbed SourTrade, which it says has been active since late 2024. According to Confiant, the operation impersonates trading and crypto brands — including TradingView, Solana, and Luno — to target retail traders and crypto users.

The notable technical wrinkle: rather than serving a single complete malicious executable from a fixed URL, SourTrade delivers the payload in pieces and has the victim's own browser assemble the final Windows executable, built on top of a legitimate Bun runtime.

Why It Matters

Splitting a payload across multiple fetches and reconstructing it client-side is a straightforward but effective way to frustrate signature- and URL-based detection: no single request or hosted file contains the complete malicious binary, and abusing a legitimate runtime like Bun as a building block can help the final artifact blend in with normal developer tooling. Because the lures impersonate well-known trading and crypto platforms, the primary at-risk population is retail traders and crypto users who click through ads or sponsored links for these brands.

What Defenders Should Watch For

• Malvertising/typosquat monitoring for ad campaigns and domains impersonating TradingView, Solana, Luno, and similar trading/crypto brands.
• Unusual downloads or writes of Bun runtime components on endpoints where Bun is not an expected developer tool, especially originating from browser processes.
• Multi-stage or fragmented download patterns from ad-tech or unfamiliar domains preceding execution of an unexpected binary.
• Browser-initiated processes that assemble or write executable files to disk shortly after visiting finance/crypto-themed sites reached via ads.
• User awareness for traders: treat sponsored/ad-served links to trading and crypto platforms with extra scrutiny, and verify software downloads only from official sources.

Confiant's report does not detail the specific payload's ultimate objective beyond the delivery mechanism, so defenders should treat this as an emerging technique to monitor rather than a fully characterized threat.

Developing Intelligence

This is a net-new report on active malvertising tradecraft and does not correspond to a specific CVE. Details may evolve as more analysis emerges. For the original reporting, see The Hacker News coverage of the SourTrade campaign.