A sophisticated malvertising campaign named SourTrade is leveraging browsers to assemble Windows executables, targeting retail traders and cryptocurrency investors across 12 countries. Discovered by Confiant, this operation impersonates popular trading platforms like TradingView, Solana, and Luno to lure victims. Instead of distributing a single malicious file, SourTrade ingeniously uses the Bun runtime to assemble the executable in-memory, making it difficult for static detection tools to identify. The landing pages involved in the attack are designed to fingerprint visitors, showing nothing to suspected researchers or bots but presenting legitimate-looking pages to real users.
The attack chain does not depend on browser vulnerabilities or the removal of the Mark of the Web. Instead, the process begins with the registration of a ServiceWorker, which works alongside a SharedWorker to fetch a Bun runtime from a secondary domain. This runtime is then used, in combination with attacker-supplied Portable Executable headers and JavaScriptCore bytecode, to assemble a complete Windows executable. The randomness introduced by session-specific values ensures each victim receives a slightly different file, evading hash-based detection methods.
Once assembled, the executable is delivered through a hidden iframe navigation, with the ServiceWorker handling the download. This method cleverly masks the origin of the malicious components as the landing page itself, complicating detection efforts. The campaign's evolution from its earlier forms, which used open-source libraries like StreamSaver.js, indicates a constant refinement of its tactics. While Bitdefender previously linked a related campaign to the credential-stealing payload JSCEAL, Confiant has not confirmed this for the current variant.
Security teams should note that there is no immediate software patch to counter this threat. The per-session unique builds of the malware highlight the limitations of simple hash-based detections. Instead, defenders must scrutinize the entire delivery chain, from ad referral to the final file landing on the disk, to effectively counter this threat. Confiant has shared hash values and a list of malicious domains to aid in detection, although no specific threat actor has been identified.