Malvertising Campaign SourTrade Forces Browsers to Assemble Malware On‑The‑Fly

The latest wave of malvertising is rewriting how threat actors deliver Windows payloads. Instead of hosting a monolithic executable, the SourTrade operation fragments the malicious code and leverages a legitimate Bun JavaScript runtime already present in the victim’s browser environment.

malvertising technique splits malware into fragments

Once the fragments load, the browser reassembles them in memory, effectively compiling a fresh executable on the fly. Confiant, which first reported the campaign on July 23, 2026, says the actors have been active since late 2024, masquerading as platforms such as TradingView, Solana and Luno to lure retail traders.

“We observed a steady rise in infection attempts, ↑ 12% month over month, while detection efficacy fell ↓ 8%,” a Confiant analyst noted.

The approach sidesteps traditional URL‑based blacklists, forcing security tools to inspect runtime behavior rather than static files. Analysts warn that the reliance on a legitimate runtime makes heuristic detection more challenging. For broader context on how cyber threats have evolved during the pandemic era, see recent coverage by Reuters and Bloomberg. Organizations should prioritize behavior‑based monitoring and sandboxing of JavaScript runtimes to mitigate this emerging vector.