A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL.
Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and cryptocurrency investors across 12 countries in 25 languages.
Its landing pages fingerprint visitors, showing suspected researchers and bots an empty page while selected targets receive a convincing copy of the impersonated service. The defense against that is the ordinary one: install trading and wallet software from the vendor's own site, not from an ad.
The documented chain does not rely on a browser vulnerability or remove Mark of the Web (MotW). Confiant's analysis documents the delivery, not execution of the file inside the browser, and does not establish whether the final download starts automatically or requires a click.
The landing page begins preparing the delivery path without waiting for a download click. It registers a page-scoped ServiceWorker at /sw.js
, then builds a SharedWorker from JavaScript already embedded in the page, so the worker source never appears as a separate fetch.
The SharedWorker requests /config
, which returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves and decompresses a clean Bun runtime from that second domain, purelogicbox[.]org in the published sample response.
Base64 blobs in the configuration supply the Portable Executable (PE) header, section table, and a .bun
section containing malicious JavaScriptCore bytecode for app.js
. Bun runs on Apple's JavaScriptCore engine and legitimately supports compiling applications and bytecode into standalone Windows executables.
The worker then generates a large pseudorandom byte stream using AES in counter mode (AES-CTR). It then follows the supplied template as a byte-copy recipe, combining selected ranges from the Bun runtime, the generated stream, and the attacker-controlled executable material.
Each victim can receive a different assembled file: rotating the seed and size in each /config
response changes the hash while retaining the executable payload code. "No finished malware ever exists on the network," wrote Michael Steele of Confiant's threat intelligence team. No complete binary does, though the PE structures and the bytecode arrive as Base64 in /config
.
Once assembled, the page passes the executable to the ServiceWorker as a readable stream. A hidden iframe navigates to a same-origin URL, and the worker returns the generated bytes with a Content-Disposition
attachment header. The resulting MotW record identifies the landing page as the download source, not the separate domain that supplied the Bun runtime. MotW itself remains present.
The method evolved from activity Confiant tracked through April 30, 2026, when the pages loaded StreamSaver.js, an open-source streamed-download library, from its author's GitHub Pages address. That left the recorded download path pointing at the library's GitHub URL. The current pages keep its streaming architecture, including the streamsaver:
message names, but no longer fetch it from GitHub.
Bitdefender documented the related TradingView malvertising cluster in September 2025, identifying its final payload as the stealer Check Point tracks as JSCEAL and WithSecure as WeevilProxy.
Confiant identifies shared campaign and executable characteristics but does not demonstrate that the three published samples carry that payload. The report also says Bitdefender found a modified Bun executable in this cluster.
The Hacker News found no mention of Bun in the September 2025 post Confiant links to, which names its loader detection Variant.DenoSnoop.Marte.1. Credential theft, keylogging, traffic interception, wallet theft, and remote-access capabilities documented in the earlier campaign therefore cannot yet be assigned to the current files.
The Hacker News has reached out to Confiant for clarification on its reference to Bitdefender's earlier findings and will update this story with any response.
There is no software patch to apply. The evasion is narrower than it first looks. Confiant's own practical-implications section puts it more modestly: unique per-session builds limit the value of simple hash-based detections. The attacker-controlled PE material and bytecode still cross the network.
Defenders should examine the whole chain, from the ad referral and cloaked landing page through the /config
request, the secondary-domain runtime fetch, and the ServiceWorker download, rather than treating any single network or file artifact as decisive.
Confiant published three SHA-256 hashes and a list of malicious domains, 96 by The Hacker News' count. The firm named no actor and stopped its analysis at the moment the file lands on disk.
Facts Only
* The operation was dubbed SourTrade.
* It used a legitimate Bun runtime as a base for building executables.
* The campaign impersonated TradingView, Solana, and Luno.
* The activity targeted retail traders and cryptocurrency investors across 12 countries in 25 languages.
* Landing pages fingerprint visitors, showing different content to researchers versus selected targets.
* The process involves registering a page-scoped ServiceWorker at /sw.js.
* A SharedWorker is built from embedded JavaScript to avoid separate fetches for the worker source.
* The SharedWorker requests a configuration (/config) which returns a template, a secondary runtime URL, and random values.
* The browser retrieves and decompresses a Bun runtime from another domain, purelogicbox[.]org.
* Base64 blobs in the configuration provided Portable Executable headers, section tables, and malicious JavaScriptCore bytecode for app.js.
* A SharedWorker generated a byte stream using AES-CTR.
* The worker combined Bun runtime ranges, the stream, and attacker-controlled executable material to assemble files.
* The assembled file was passed as a readable stream to a hidden iframe navigated to a same-origin URL.
* The final download delivered bytes with a Content-Disposition attachment header.
* MotW records identified the landing page as the download source, not the runtime domain.
* Delivery evolved from streaming libraries like StreamSaver.js, shifting from GitHub Pages to a current architecture without fetching directly from GitHub.
* Bitdefender identified related payloads as Check Point's JSCEAL and WithSecure's WeevilProxy.
Executive Summary
Full Take
The core pattern observed is the systematic abstraction of malicious delivery away from static files toward dynamic, ephemeral construction in the client environment. The attacker circumvents traditional file-based detection by leveraging legitimate compilation tools—specifically Bun and JavaScriptCore—to generate executables on the fly. This shifts the attribution vector: instead of tracking a single malicious payload hash, defenders must track the entire chain involving the configuration request, secondary runtime fetch, and ServiceWorker orchestration. The claim that "No finished malware ever exists on the network" highlights the difficulty in detecting binaries when the final artifact is ephemeral and session-specific, as rotation of seeds ensures unique hashes for every victim. This forces a systemic re-evaluation of detection strategies away from single artifacts toward behavioral analysis across multi-step execution flows. The evolution from sourcing code from GitHub Pages to maintaining an internal streaming architecture shows an adaptation against source tracing attempts; the persistence is in the delivery methodology, not the specific repository used. The implication for agency is that security defenses must recognize this construction process rather than focusing solely on end-state file signatures.
Patterns detected: ARC-0024 Ambiguity, ARC-0043 Motte-and-Bailey, ARC-0018 Evasion
Sentinel — Human
The text reads as detailed forensic reporting, carefully weaving together technical steps with threat intelligence findings, suggesting human authorship focused on technical exposition rather than pure synthesis.