Your Browser Is Building Malware: The SourTrade Attack You Need to Know About

Emily Davis · 2026-07-25

A new malvertising campaign called SourTrade is turning your browser into a weapon builder. Instead of dropping a single malicious file from a fixed URL, it makes the victim's browser assemble the final Windows executable on its own using a legitimate Bun runtime as its base. Confiant detailed this campaign on July 23, 2026, and said it has been operating since late 2024. The attackers impersonated platforms like TradingView, Solana, and Luno to target retail traders and cryptocurrency investors. This is a huge shift in how malware gets delivered, and it's something every security professional needs to understand. ### How SourTrade Works The attack starts with a malvertising ad that looks legitimate. When you click on it, your browser doesn't just download a file. Instead, it downloads pieces of code that are then assembled right in your browser using Bun, a legitimate JavaScript runtime. This makes detection much harder because the final malicious file doesn't exist anywhere until it's built on your machine. - **No single malicious file:** Traditional malware detection relies on finding a known bad file. With SourTrade, there is no single file to catch until it's too late. - **Legitimate tool used:** Bun is a real, widely used runtime. Attackers are abusing it to hide their payload. - **Targeted audience:** Retail traders and crypto investors are the primary targets, but anyone could be hit. ### Why This Matters for Antidetect Browser Users For professionals using antidetect browsers to manage multiple accounts, this attack is particularly dangerous. Antidetect browsers are designed to protect your identity, but they can't protect you from a malicious ad that makes your browser build malware. The browser itself becomes the threat actor. > "The browser is no longer just a gateway to the internet. It's now a potential assembly line for malware." — Security researcher at Confiant This means you need to be extra careful about the ads you click, even if you're using a hardened browser. No tool is a silver bullet. ### How to Protect Yourself Here are some practical steps you can take to stay safe: - **Use ad blockers:** A good ad blocker can prevent malvertising from even loading. This is your first line of defense. - **Keep your browser updated:** Modern browsers have security features that can detect and block suspicious behaviors like unexpected code execution. - **Be skeptical of ads:** If an ad seems too good to be true, it probably is. Don't click on flashy offers for TradingView, Solana, or Luno. - **Run a reliable security suite:** Antivirus and anti-malware tools can help catch the assembled executable before it runs. - **Use a dedicated antidetect browser:** While no browser is 100% safe, antidetect browsers add layers of fingerprint protection that can make you a harder target. ### The Bigger Picture This attack shows how creative cybercriminals are getting. They're not just sending malware anymore. They're using your own computer's resources to build it. This is a wake-up call for everyone who works in digital privacy or security. At Antidetectbrowsershub, we recommend staying informed and adapting your defenses. The days of simple malware downloads are over. Now, you have to worry about your browser becoming a factory for malicious code. Stay safe out there. And remember: if you're not using an antidetect browser yet, you're leaving yourself vulnerable in more ways than one.