A malvertising operation called SourTrade tricks browsers into assembling malware using a legitimate Bun runtime, targeting retail traders on TradingView, Solana, and Luno since late 2024.
Imagine visiting a legitimate-looking ad, and moments later, your browser starts assembling malicious code piece by piece. That's exactly what a malvertising campaign called SourTrade is pulling off. Instead of downloading a single file that antivirus software can spot, this attack tricks your browser into building the final Windows executable right on your machine using a legitimate tool called the Bun runtime.
Confiant, a security firm that tracks these threats, broke down the campaign on July 23, 2026. They say it's been active since late 2024, and it's been impersonating well-known platforms like TradingView, Solana, and Luno. The goal? To target retail traders who are already used to clicking on ads for investment tools. It's a clever twist on an old problem, and it's worth understanding how it works.
### How SourTrade Makes Your Browser Do the Dirty Work
The core trick here is fragmentation. Instead of serving one complete malicious file from a fixed URL, SourTrade sends malware in small, harmless-looking pieces. Your browser then reassembles these pieces using the Bun runtime, which is a legitimate JavaScript runtime often used for web development. Because Bun is recognized as safe by most security tools, the process flies under the radar.
Here's a quick breakdown of the attack flow:
- You click on a malvertising ad that looks like it came from TradingView or a similar platform.
- The ad loads a script that downloads multiple small files, each one seemingly innocent.
- Your browser uses Bun to stitch these pieces together into a full Windows executable.
- The final payload runs on your system, often stealing credentials or installing additional malware.
It's a bit like ordering a bookshelf from IKEA but having the instructions arrive in pieces from different delivery trucks. Only in this case, the final product is a Trojan horse.
### Why This Is Harder to Catch
Traditional security tools scan for known malware signatures. If a file matches a pattern, it gets blocked. But SourTrade's approach bypasses that by never delivering a complete malicious file until it's already inside your browser. The Bun runtime is legitimate, so antivirus software doesn't flag it. The individual pieces are too small and random to trigger alarms.
> "The attacker doesn't need to hide the malware in a clever packer or obfuscator," says Confiant. "They just let the browser do the work for them."
This method also makes it harder for analysts to reverse-engineer the attack because the payload only exists temporarily in memory. By the time you notice something's wrong, the evidence is gone.
### Who Is at Risk and What You Can Do About It
Right now, SourTrade is specifically targeting retail traders in the United States. If you use platforms like TradingView, Solana, or Luno, you're in their crosshairs. But any professional who clicks on ads related to finance or investing could be at risk.
To protect yourself, consider these steps:
- Use an ad blocker to reduce your exposure to malvertising.
- Keep your browser and operating system updated to patch known vulnerabilities.
- Run a reputable antivirus program that includes behavior-based detection, not just signature scanning.
- Be cautious with ads, even on trusted sites. If an offer seems too good to be true, it probably is.
### The Bigger Picture
SourTrade is just one example of a growing trend: attackers are getting more creative about using legitimate tools for malicious purposes. Bun runtime isn't the only one. We've seen similar techniques with Node.js, Python interpreters, and even PowerShell. The key takeaway is that no tool is inherently safe if it can be repurposed.
For professionals in the antidetect browser space, this is a reminder that fingerprinting and session isolation aren't just about privacy. They're also about security. Using a browser that isolates each session can prevent malvertising from spreading across your accounts or devices.
In a world where your browser can be tricked into building its own malware, staying vigilant is more important than ever. Keep your tools updated, question every ad, and don't assume that because something looks legitimate, it is.
