"No finished malware ever exists on the network," wrote Michael Steele of Confiant's threat intelligence team.
How SourTrade assembles Windows executables inside the browser
Confiant's July 23, 2026, analysis shows the malvertising cluster it calls SourTrade does not deliver a single binary file over HTTP. Instead the landing page registers a page-scoped ServiceWorker at /sw.js, constructs a SharedWorker from JavaScript already embedded in the page, and has that SharedWorker request /config. The /config response returns a template, a secondary runtime URL and session-specific random values.
The browser fetches and decompresses a clean Bun runtime from a secondary domain (purelogicbox[.]org in the published sample). Base64 blobs in the configuration supply the Portable Executable (PE) header, section table, and a .bun section containing JavaScriptCore bytecode for app.js. Bun runs on Apple's JavaScriptCore engine and legitimately supports compiling applications and bytecode into standalone Windows executables; the attackers used it as the benign base in the observed chain.
The worker generates a large pseudorandom byte stream using AES in counter mode (AES-CTR) and then follows the supplied template as a byte‑copy recipe, combining selected ranges from the Bun runtime, the generated stream, and attacker-controlled executable material. Because each /config response can rotate the seed and size, each victim can receive a different assembled file even while retaining the same executable payload code.
When assembly completes, the page hands the generated executable to the ServiceWorker as a readable stream. A hidden iframe navigates to a same‑origin URL and the worker returns the generated bytes with a Content‑Disposition: attachment header so the browser records the download. Confiant documents delivery of the file into the browser but does not demonstrate in‑browser execution nor whether the final download starts automatically or requires a click.
Cloaking, targeting, and the landing‑page tradecraft
Confiant reports SourTrade has operated since late 2024 and impersonated TradingView, Solana and Luno to focus on retail traders and cryptocurrency investors across 12 countries in 25 languages. The landing pages fingerprint visitors and show suspected researchers and bots an empty page; selected targets see convincing copies of the impersonated service. Confiant notes a simple defense point: install trading and wallet software from the vendor's own site, not from an ad.
Why simple hash detection and single‑artifact hunting are insufficient
Because the final executable is assembled in the victim's browser from pieces that arrive in session‑specific form, "no finished malware ever exists on the network," and simple hash‑based detections lose value. Confiant frames the practical implication modestly: unique per‑session builds limit the usefulness of static hash signatures. That said, attacker‑controlled PE material and the JavaScriptCore bytecode do cross the network as Base64 in /config, and those network artifacts remain detectable if defenders look for them.
The documented chain does not rely on a browser vulnerability and does not remove Mark of the Web (MotW); MotW entries record the landing page as the download source rather than the secondary domain that supplied the Bun runtime. Confiant stopped its analysis at the moment the file lands on disk and did not publish any evidence of in‑memory execution.
What this means for security teams, open‑source maintainers, and end users
- Security teams and incident responders should examine the full delivery chain — from the ad referral and cloaked landing page through the /config request, the secondary‑domain runtime fetch, and the ServiceWorker download — rather than treating any single network or file artifact as decisive.
- Open‑source maintainers: Confiant traced earlier activity through April 30, 2026, when the pages loaded StreamSaver.js from its GitHub Pages address; the present pages preserve the streaming architecture (including streamsaver: message names) but no longer fetch the library from GitHub. That change alters which third‑party hosts appear in forensic records.
- End users and traders should avoid installing wallet or trading software from links in ads and instead download vendor software from the vendor's official site.
Indicators, earlier clusters, and attribution limits
Confiant published three SHA‑256 hashes and a list of malicious domains; The Hacker News counted 96 domains in the published list. Confiant identifies shared campaign and executable characteristics but does not demonstrate that the three published samples carry the payload Bitdefender documented in a September 2025 TradingView malvertising cluster. Bitdefender earlier identified that cluster's final payload as the stealer Check Point tracks as JSCEAL and WithSecure calls WeevilProxy; Confiant's report says Bitdefender found a modified Bun executable in that cluster.
The Hacker News also notes the September 2025 post Confiant links to does not mention Bun and names a loader detection Variant.DenoSnoop.Marte.1. The Hacker News has reached out to Confiant for clarification on Confiant's reference to Bitdefender's earlier findings.
Confiant did not name an actor and stopped its analysis at the moment the file lands on disk. There is no software patch to apply to browsers for this delivery technique; the practical defensive work is in detection of the end‑to‑end chain and in user practices around downloading and installing sensitive financial software.
