Security teams have spent decades treating malware delivery as a movement problem. An attacker places a malicious file on a server, transfers it across the network, and persuades a user or system to execute it. Defenders inspect the hosting domain, the download URL, the network payload, the file hash, the digital signature, and the executable that reaches the endpoint.
The SourTrade malvertising campaign changes the shape of that process. Its infrastructure sends a browser several ingredients and a set of assembly instructions. The browser retrieves a legitimate Bun runtime, generates a large stream of pseudorandom data, inserts attacker-controlled executable structures and JavaScriptCore bytecode, and produces a Windows executable in memory. A Service Worker then presents the finished stream to the browser as a same-origin download. Each session can yield a different file hash.
Most coverage has focused on the technical novelty: malware assembled inside a browser. The deeper issue lies in the way this technique divides malicious intent across several individually ordinary activities. The campaign turns the gaps between security products into part of the malware architecture.
A Malware Sample Becomes a Temporary Event
Traditional malware intelligence starts with an object. Analysts collect a file, calculate its hash, detonate it, extract indicators, and distribute those indicators to security products. SourTrade converts that object into a temporary result generated for one browser session.
The landing page requests a configuration containing a runtime location, session-specific random values, Base64-encoded executable material, and a template describing which byte ranges belong in the final output. The browser then combines selected sections of the legitimate runtime, attacker-supplied Portable Executable structures, malicious “.bun” section data, and locally generated AES-CTR bytes. Changing the random seed and output size produces a different binary while preserving the executable payload.
This makes the malware file resemble a personalised product created at the point of delivery. The stable asset becomes the manufacturing process: the configuration format, the assembly template, the worker logic, the relationships among domains, and the sequence of browser actions.
That distinction matters because many security systems still rank indicators by object identity. A hash answers the question, “Have we seen this exact file before?” SourTrade asks a different question: “Have we seen this browser perform this particular construction process before?”
The second question requires telemetry that spans the page, its workers, its network requests, its generated byte streams, the download event, and the resulting endpoint process. Few security controls hold that complete view.
Every Layer Sees an Innocent Fragment
SourTrade uses the browser as an observability boundary.
The advertising platform sees a campaign promoting a trading or cryptocurrency product. The landing page uses cloaking to show selected visitors a convincing imitation of TradingView, Solana, or Luno while presenting other visitors with an empty page. Confiant observed targeting across 12 countries and 25 languages, along with tracking logic associated with Google, Meta, and X advertising ecosystems.
The network layer sees a configuration response, encoded blobs, JavaScript, and the retrieval of a legitimate Bun runtime. The Bun project officially supports compiling JavaScript and TypeScript applications into standalone executables that include a copy of the runtime. This legitimate packaging capability gives attackers a ready-made executable foundation.
The browser sees standard web capabilities. A Shared Worker can run code outside the page’s main execution thread. A Service Worker can intercept fetch events and supply a custom response to a controlled page. These features support offline applications, caching, background operations, and streamed content. SourTrade combines them into a local file-production pipeline.
The endpoint sees a newly downloaded executable carrying Mark of the Web. The recorded source points toward the same-origin landing-page path used by the Service Worker, while one of the executable’s major ingredients came from a separate runtime domain. Windows and Microsoft Defender SmartScreen use origin, reputation, and zone information as part of their protection model, making the accuracy and completeness of provenance especially relevant.
Each system records a valid part of the story. The attack succeeds through the absence of a shared narrative.
The Browser Has Become a Software Supply Chain
The campaign also points toward a broader change in malware development. Attackers increasingly use legitimate language runtimes as portable execution environments.
Microsoft documented campaigns that used Node.js to deliver malware and information-stealing payloads. Malwarebytes later identified attackers packaging NWHStealer with Bun and described Bun’s self-contained architecture and relative novelty as useful properties for malware distribution. Other 2026 campaigns have used Deno to run remote-access tools and steal data from browsers, wallets, and applications.
SourTrade takes this pattern further. The runtime becomes one component in a browser-operated build chain. The attacker gains the benefits of a legitimate interpreter, a flexible bytecode payload, and per-session file diversification.
This creates a compact criminal software supply chain. The ad supplies acquisition. The cloaking system performs audience qualification. The landing page acts as an installer interface. The configuration endpoint acts as a build server. Bun supplies the execution engine. Browser workers act as the assembly machinery. The Service Worker acts as the distribution layer.
The victim’s machine contributes the final labour.
This structure also gives campaign operators commercial advantages. They can adjust brands, countries, languages, payload material, randomisation parameters, and advertising campaigns as separate components. Confiant’s research shows a cluster active since late 2024 whose delivery method evolved from a StreamSaver.js-based flow into a self-contained worker architecture during 2026.
The malware pipeline starts to resemble a performance-marketing system with a programmable fulfilment layer.
The Assembly Recipe Is the Real Indicator
Hash-based indicators still have value after endpoint collection. Their useful life shrinks when each visitor receives a newly constructed binary.
The more durable indicators live one level above the file. They include the registration of a page-scoped Service Worker, creation of a Shared Worker from an in-memory Blob, a configuration response containing a template and large random-stream parameters, retrieval of a compressed standalone runtime from a second domain, construction of a large readable stream, and a hidden iframe that triggers a Service Worker-controlled attachment response.
Each action has legitimate uses. Their ordered combination carries the signal.
This suggests a richer threat-intelligence unit: the assembly graph. An assembly graph describes which components arrived from which origins, which bytes were generated locally, which browser context transformed them, and which process eventually executed the result.
Such a graph would preserve relationships that disappear inside a conventional file record. It could show that a trusted runtime supplied most of the executable’s mass while a small configuration response supplied its structure and payload. It could connect an ad referral to a cloaked page, the page to a worker, the worker to a runtime domain, and the resulting file to a later credential-theft process.
Security teams already use process trees to understand endpoint behaviour. Browser-built malware calls for a comparable model covering the period before the file exists.
Detection Needs to Move Earlier Than the Download
The most valuable detection opportunity may appear during construction.
A browser session that registers a Service Worker and immediately uses it to return a large executable attachment deserves scrutiny. A page that fetches a standalone runtime, decodes Portable Executable structures from Base64, generates hundreds of megabytes of pseudorandom bytes, and joins those sources into a streamed download creates a distinctive behavioural sequence.
Browser vendors hold the clearest view of that sequence. They can observe worker registration, Blob-created scripts, cross-origin runtime retrieval, sustained cryptographic byte generation, response construction, attachment headers, hidden-frame navigation, and the creation of an executable download.
Research into Service Worker abuse has already proposed behavioural monitoring and stricter browser policies, with Chromium experiments suggesting that stronger controls could cover risky patterns while preserving common production use cases.
Enterprise browsers and secure web gateways can also treat executable provenance as a chain rather than a single URL. A download created from a Service Worker response could carry metadata describing every contributing origin. Endpoint tools could receive that lineage with the file. Sandboxes could recreate the configuration request and browser assembly routine before analysing the binary.
These changes would shift detection from reputation toward causality.
Malvertising Has Become an Initial-Access Platform
SourTrade also shows how advertising infrastructure supports more than victim acquisition. It supports selection, measurement, localisation, experimentation, and delivery optimisation.
The campaign targets retail traders and cryptocurrency users through brands that naturally offer desktop applications. The promise of premium access or trading software creates a believable reason to download an executable. Localised ads and landing pages improve conversion, while cloaking preserves the campaign by filtering researchers and automated scanners. Advertising pixels provide campaign operators with performance data across multiple platforms.
This makes malvertising an operational layer of the attack. The same machinery that helps legitimate companies find high-intent customers helps attackers identify high-value victims at the moment they are ready to install software.
The security response therefore reaches beyond blocking malicious domains. Trading platforms, cryptocurrency companies, software vendors, ad networks, browsers, and endpoint providers each own a piece of the delivery chain. Shared campaign intelligence can connect brand impersonation, advertising accounts, redirect infrastructure, cloaking fingerprints, worker scripts, runtime sources, and endpoint behaviour.
The File Is the Final Clue, Rather Than the First
SourTrade’s technical method attracts attention because a browser assembles a Windows executable. Its larger significance comes from the way it distributes evidence.
The malicious programme exists as a relationship among legitimate code, attacker-controlled fragments, generated bytes, browser features, advertising traffic, and user action. A complete executable appears only at the end of that relationship. Its hash may remain unique to a single session.
Defenders can respond by treating malware delivery as a production process. The browser becomes a build environment. The configuration becomes a recipe. The worker chain becomes machinery. The ad campaign becomes distribution. The resulting file becomes one output from a repeatable system.
The attacker’s most durable asset is the factory.
Security tools that learn to identify the factory can detect every product it creates.
Previous post