A malvertising operation dubbed SourTrade is making victims’ browsers construct the ultimate Home windows executable themselves, utilizing a legit Bun runtime as its base as a substitute of serving one full malicious file from a hard and fast URL.
Confiant, which detailed the marketing campaign on July 23, 2026, stated it has operated since late 2024 and impersonated TradingView, Solana, and Luno to focus on retail merchants and cryptocurrency buyers throughout 12 international locations in 25 languages.
Its touchdown pages fingerprint guests, displaying suspected researchers and bots an empty web page whereas chosen targets obtain a convincing copy of the impersonated service. The protection towards that’s the unusual one: set up buying and selling and pockets software program from the seller’s personal web site, not from an advert.
The documented chain doesn’t depend on a browser vulnerability or take away Mark of the Net (MotW). Confiant’s evaluation paperwork the supply, not execution of the file contained in the browser, and doesn’t set up whether or not the ultimate obtain begins mechanically or requires a click on.
The touchdown web page begins getting ready the supply path with out ready for a obtain click on. It registers a page-scoped ServiceWorker at /sw.js, then builds a SharedWorker from JavaScript already embedded within the web page, so the employee supply by no means seems as a separate fetch.
The SharedWorker requests /config, which returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves and decompresses a clear Bun runtime from that second area, purelogicbox[.]org within the printed pattern response.
Base64 blobs within the configuration provide the Transportable Executable (PE) header, part desk, and a .bun part containing malicious JavaScriptCore bytecode for app.js. Bun runs on Apple’s JavaScriptCore engine and legitimately helps compiling purposes and bytecode into standalone Home windows executables.
The employee then generates a big pseudorandom byte stream utilizing AES in counter mode (AES-CTR). It then follows the equipped template as a byte-copy recipe, combining chosen ranges from the Bun runtime, the generated stream, and the attacker-controlled executable materials.
Every sufferer can obtain a unique assembled file: rotating the seed and dimension in every /config response modifications the hash whereas retaining the executable payload code. “No completed malware ever exists on the community,” wrote Michael Steele of Confiant’s risk intelligence group. No full binary does, although the PE buildings and the bytecode arrive as Base64 in /config.
As soon as assembled, the web page passes the executable to the ServiceWorker as a readable stream. A hidden iframe navigates to a same-origin URL, and the employee returns the generated bytes with a Content material-Disposition attachment header. The ensuing MotW report identifies the touchdown web page because the obtain supply, not the separate area that equipped the Bun runtime. MotW itself stays current.
The tactic developed from exercise Confiant tracked via April 30, 2026, when the pages loaded StreamSaver.js, an open-source streamed-download library, from its creator’s GitHub Pages deal with. That left the recorded obtain path pointing on the library’s GitHub URL. The present pages preserve its streaming structure, together with the streamsaver: message names, however not fetch it from GitHub.
Bitdefender documented the associated TradingView malvertising cluster in September 2025, figuring out its remaining payload because the stealer Test Level tracks as JSCEAL and WithSecure as WeevilProxy.
Confiant identifies shared marketing campaign and executable traits however doesn’t exhibit that the three printed samples carry that payload. The report additionally says Bitdefender discovered a modified Bun executable on this cluster.
The Hacker Information discovered no point out of Bun within the September 2025 submit Confiant hyperlinks to, which names its loader detection Variant.DenoSnoop.Marte.1. Credential theft, keylogging, visitors interception, pockets theft, and remote-access capabilities documented within the earlier marketing campaign due to this fact can not but be assigned to the present information.
The Hacker Information has reached out to Confiant for clarification on its reference to Bitdefender’s earlier findings and can replace this story with any response.
There is no such thing as a software program patch to use. The evasion is narrower than it first appears. Confiant’s personal practical-implications part places it extra modestly: distinctive per-session builds restrict the worth of straightforward hash-based detections. The attacker-controlled PE materials and bytecode nonetheless cross the community.
Defenders ought to look at the entire chain, from the advert referral and cloaked touchdown web page via the /config request, the secondary-domain runtime fetch, and the ServiceWorker obtain, slightly than treating any single community or file artifact as decisive.
Confiant printed three SHA-256 hashes and an inventory of malicious domains, 96 by The Hacker Information’ rely. The agency named no actor and stopped its evaluation in the intervening time the file lands on disk.
