A malvertising campaign called SourTrade tricks your browser into building malware using a legitimate Bun runtime. It targets traders on TradingView, Solana, and Luno since late 2024.
Imagine clicking on what looks like a legitimate ad for TradingView or Solana, and your browser quietly starts assembling a Windows executable piece by piece. That's exactly what a malvertising campaign called SourTrade has been doing since late 2024.
Security researchers at Confiant blew the whistle on July 23, 2026, revealing a clever attack that doesn't just drop malware on your computer the old-fashioned way. Instead, it uses your own browser as a construction site, building the final malicious file right under your nose.
### How SourTrade Works
The trick is surprisingly elegant. Instead of serving one complete malicious file from a fixed URL, SourTrade sends the malware in pieces. Your browser then uses a legitimate Bun runtime to assemble those pieces into a working Windows executable. Bun is a real, open-source JavaScript runtime - perfectly legitimate on its own. The attackers just abuse it.
This approach has some serious advantages for the bad guys. Traditional malware downloads are easy for security tools to spot - a single file coming from a suspicious URL triggers alarms. But when the browser builds the executable locally, it bypasses many of those checks.
### Who's Being Targeted
SourTrade impersonates three major brands: TradingView, Solana, and Luno. All three are popular with retail traders and cryptocurrency investors. That's no accident. The attackers are going after people who are used to clicking on financial ads and might not think twice about a sponsored link.
- TradingView is a charting platform used by millions of traders worldwide
- Solana is a blockchain platform with a huge crypto community
- Luno is a cryptocurrency exchange with a strong retail presence
If you trade crypto or use financial platforms, you're in the crosshairs.
### Why This Matters for Antidetect Browser Users
For professionals using antidetect browsers to manage multiple accounts, this attack is especially dangerous. Antidetect browsers are designed to create separate digital fingerprints for each account, which is great for privacy. But they also rely on the browser environment being secure.
If a malvertising campaign can turn any browser - including an antidetect one - into a malware factory, then the entire setup is compromised. Your careful fingerprint management doesn't matter if the browser itself is building harmful executables.
### What You Can Do to Stay Safe
Here are some practical steps to protect yourself:
- Use ad blockers. This is the single most effective defense against malvertising. Tools like uBlock Origin can stop malicious ads before they load.
- Keep your browser updated. Modern browsers have sandboxing features that can limit what malicious code can do.
- Be skeptical of sponsored ads, especially for financial platforms. Always type the URL directly instead of clicking.
- Consider using a dedicated antidetect browser with built-in security features. Some solutions offer additional layers of protection against drive-by downloads.
### The Bigger Picture
Malvertising is nothing new, but SourTrade shows how creative attackers are getting. By using legitimate tools like Bun, they blur the line between safe and malicious. The browser is supposed to be a trusted environment. When it becomes the attack vector, everyone needs to rethink their defenses.
For businesses and professionals who rely on antidetect technology, this is a wake-up call. The browser is the front line. If it's compromised, nothing else matters.
### Final Thoughts
Stay vigilant out there. The internet is full of clever traps, and SourTrade is one of the sneakiest we've seen in a while. Keep your tools updated, use ad blockers, and never assume an ad is safe just because it looks professional.
If you're managing multiple accounts for work, consider investing in a quality antidetect browser that prioritizes security. It's worth the peace of mind.
