Your Browser Is Quietly Assembling Malware Piece by Piece

Michael Miller · 2026-07-25

Imagine downloading a piece of furniture from a store, but instead of getting a complete table, you receive a pile of boards and screws with instructions for your browser to build it for you. That's the unsettling reality behind a new malvertising operation called SourTrade. This campaign, active since late 2024, doesn't deliver a single malicious file from a fixed URL. Instead, it uses a legitimate runtime called Bun to have your browser assemble the final Windows executable on the fly. Confiant, a cybersecurity firm, broke the story on July 23, 2026, and what they found is a clever twist on an old threat. ### How SourTrade Works Here's the breakdown: You're browsing the web, and a malicious ad pops up. It looks legit—maybe it mimics a popular trading platform like TradingView, Solana, or Luno. You click, and instead of downloading a virus, your browser pulls in pieces of code from different sources. Using Bun, a runtime that's normally used for JavaScript development, the browser stitches those pieces together into a working malware executable. - **No single file to detect**: Traditional antivirus software looks for known malicious files. SourTrade avoids this by having your browser build the malware locally. - **Targets retail traders**: The campaign impersonates well-known trading brands to trick people who are likely to have financial data on their devices. - **Active since late 2024**: This isn't a new experiment; it's been running for over a year, evolving to avoid detection. ### Why This Matters for Your Security This approach is dangerous because it bypasses many traditional security measures. Your browser is essentially a factory for malware, and you don't even know it's happening. The use of Bun is especially tricky—it's a legitimate tool that developers use, so it's not automatically flagged as suspicious. Think about it: Most people assume if they don't download a file, they're safe. SourTrade exploits that assumption. The malware is assembled in memory, making it harder for scanners to catch. Once the executable is built, it can steal passwords, financial info, or even lock your files for ransom. ### Who's at Risk? Retail traders are the primary targets. The campaign impersonates: - **TradingView**: A popular charting platform for stocks and crypto. - **Solana**: A blockchain network often used for trading. - **Luno**: A cryptocurrency exchange. If you're in the U.S. and you trade stocks or crypto, you're a prime target. The ads look professional, and the landing pages are convincing. One wrong click, and your browser starts building malware. ### What You Can Do First, don't trust ads. Even on reputable sites, malvertising can slip through. Use an ad blocker, and consider a browser with strong security features. Second, keep your software updated—especially your browser and operating system. Third, if you're a professional managing multiple accounts, consider using an antidetect browser. These tools mask your digital fingerprint, making it harder for malvertising campaigns to target you specifically. > "The beauty of this attack is its subtlety. It doesn't scream 'malware' because it's using legitimate pieces. But that's exactly what makes it so dangerous." — A security researcher familiar with the campaign. ### The Bigger Picture SourTrade is a reminder that cybercriminals are always innovating. They're not just sending viruses in emails anymore; they're turning your own tools against you. For professionals in the antidetect browser space, this is a wake-up call. Your browser is your gateway to the web, but it can also be your biggest vulnerability. Stay vigilant, and don't assume you're safe just because you didn't download anything. The next time you see an ad for a trading platform, think twice. Your browser might be working harder than you know.