Researchers at Confiant have detailed a malvertising campaign, dubbed SourTrade, that avoids serving a single malicious executable from a fixed URL. Instead, the operation splits the payload into pieces and has the victim’s browser reconstruct the final Windows binary itself, using a legitimate Bun JavaScript runtime as its foundation.

According to Confiant’s July 23, 2026 disclosure, the campaign has been active since late 2024. Operators impersonate well known financial and crypto brands, including TradingView, Solana, and Luno, to lure retail traders and cryptocurrency users into installing what appears to be legitimate trading or wallet software.

How the technique works

By abusing a legitimate runtime component and assembling the executable in stages rather than delivering it wholesale, SourTrade sidesteps detection methods that rely on scanning or blocklisting a single malicious download URL or file hash. Breaking the payload into pieces and reconstituting it in the browser context makes static analysis and signature based defenses substantially less effective, since no single network request or file on disk fully represents the malicious code until assembly is complete.

Why it matters

Malvertising campaigns that impersonate trusted financial platforms are particularly effective against retail traders and crypto holders, who are accustomed to downloading trading tools, charting extensions, and wallet utilities from third party sites. The use of a legitimate runtime as a delivery vehicle adds a layer of plausibility that can help malicious ads and landing pages pass casual scrutiny.

The extended operational window, running since late 2024 without full public exposure, underscores how staged and client side payload assembly can prolong a campaign’s lifespan against traditional detection pipelines.

Recommendations

  • Treat unsolicited or ad driven downloads of trading, wallet, or exchange related software with heightened scrutiny, even when branding appears legitimate.
  • Monitor for anomalous use of legitimate runtimes such as Bun in contexts where they are not expected on endpoint systems.
  • Apply browser and endpoint controls that inspect behavior and assembled artifacts rather than relying solely on static file or URL reputation.
  • Educate retail trading and crypto focused users about the risks of downloading tools via advertisements rather than official vendor channels.