Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

Summary: Confiant detailed on July 23, 2026 a malvertising operation called SourTrade that has run since late 2024, impersonating TradingView, Solana, and Luno to target retail traders and cryptocurrency investors in 12 countries across 25 languages. The campaign's landing pages use a ServiceWorker and SharedWorker to fetch a clean Bun runtime from a second domain and assemble a per-victim Windows executable in the browser from Base64-supplied PE headers and malicious JavaScriptCore bytecode, so no complete binary is served from a fixed URL.
What you should know: Because each /config response rotates the seed and size, every victim can receive a different file hash while the executable payload code stays the same, which limits the value of simple hash-based detections. Confiant also amended its report on July 26 to correct an earlier claim that Bitdefender's research referenced Bun, so the credential theft, keylogging, and wallet theft documented in the earlier TradingView cluster cannot yet be assigned to these files.

Read the original at The Hacker News ↗