ServicesBlogPricingContactContact Now
Cyber Security4 min read

SourTrade Malvertising Uses Browser to Build Malware via Bun Runtime

SourTrade Malvertising Uses Browser to Build Malware via Bun Runtime

Introduction

Security researchers have uncovered a malvertising campaign that fundamentally changes how malware reaches its victims. Dubbed SourTrade, this operation doesn't serve complete malicious executables from static URLs. Instead, it delivers fragmented code pieces through compromised ad networks and leverages the victim's own browser—powered by the legitimate Bun JavaScript runtime—to assemble a fully functional Windows executable in memory. First observed in late 2024 and detailed by Confiant on July 23, 2026, the campaign has impersonated trusted brands like TradingView, Solana, and Luno to lure retail traders into a trap that leaves almost no traditional forensic footprint.

This technique represents a significant evolution in living-off-the-land tactics. By using a signed, legitimate runtime environment already trusted by operating systems and security tools, SourTrade blurs the line between benign development activity and malicious code execution. For defenders, the implication is clear: static indicators of compromise and network-based file scanning are no longer sufficient.

How the SourTrade Attack Chain Works

The campaign follows a multi-stage process designed to evade detection at every layer:

  • Malvertising Delivery: Attackers purchase ad space on legitimate publisher sites through programmatic networks. The ads mimic cryptocurrency platforms—TradingView charts, Solana wallet interfaces, Luno exchange login pages.
  • Fingerprinting & Redirection: When a user clicks, a fingerprinting script validates the target (Windows OS, specific browser versions, geo-location). Non-targets see benign content; targets are redirected to a staging domain.
  • Bun Runtime Deployment: The staging page downloads a portable, unsigned but legitimate copy of bun.exe (the Bun runtime binary) to a temporary directory. This binary is clean—signed by the Bun project, VirusTotal-clean, and widely used by developers.
  • In-Browser Assembly: JavaScript on the page fetches encrypted, fragmented payload chunks (often base64-encoded) from multiple CDN endpoints. Using Bun's FileSystem and Subprocess APIs, the script writes chunks to disk, decrypts them, and links them into a final PE executable—all inside the browser's security context.
  • Execution & Persistence: The newly minted executable launches via Bun's spawn(), establishing command-and-control beaconing, credential harvesting, and clipboard hijacking for crypto wallet addresses.

Why This Technique Defeats Traditional Defenses

SourTrade's architecture exploits fundamental gaps in how security tools inspect traffic and behavior:

  • No Complete Malware on the Wire: Network sandboxes, proxies, and IDS/IPS never see a full PE file. They see harmless JavaScript, legitimate Bun binary downloads, and encrypted blob transfers—none individually malicious.
  • Legitimate Binary Abuse: bun.exe is a valid development tool. Blocking it breaks developer workflows. Allowlisting it creates a trusted pathway for attackers.
  • Ephemeral Artifacts: The assembled executable exists only in memory or temp folders, often deleted post-execution. Disk forensics finds nothing.
  • Browser as Build Environment: Modern browsers with WebAssembly, File System Access API, and powerful JS engines are de facto compilers. Security tools rarely monitor what a browser process writes to disk.

Target Profile: Why Crypto Traders?

The choice of TradingView, Solana, and Luno as lures is deliberate. Retail cryptocurrency traders represent high-value targets:

  • They frequently install browser extensions, trading bots, and wallet software—lowering suspicion for new binaries.
  • They hold liquid assets in hot wallets and exchange accounts accessible via clipboard hijacking and session theft.
  • They operate across multiple platforms (Windows, macOS, Linux), but SourTrade currently focuses on Windows due to Bun's native PE output capability.
  • They are accustomed to rapid software updates and beta tools, making "new runtime" prompts less alarming.

Grivyonx Expert Analysis

SourTrade signals a paradigm shift: the browser is becoming the new compiler. We've seen living-off-the-land binaries (LOLBins) abused for years—msbuild.exe, csc.exe, dotnet.exe. But Bun introduces a cross-platform, single-binary runtime with full system access, no installation required, and a permissive security model designed for developer velocity, not sandboxing. This campaign proves threat actors are now treating developer toolchains as attack infrastructure.

From a detection standpoint, organizations must move beyond file-based signatures. Behavioral telemetry should flag: (1) bun.exe executing from %TEMP% or %APPDATA% with network connections, (2) browser processes spawning bun.exe with spawn() or run() arguments, (3) rapid sequential writes of small encrypted files followed by a PE header appearing in the same directory. Grivyonx Cloud's AI-driven endpoint sensor correlates these low-signal events into high-fidelity attack narratives—detecting the intent of in-browser compilation before the final payload executes.

Mitigation Strategies for Security Teams

Defending against browser-assisted malware assembly requires layered controls:

  • Application Control: Restrict execution of unsigned binaries from user-writable paths (%TEMP%, %APPDATA%, Downloads) via AppLocker, WDAC, or third-party application control.
  • Browser Hardening: Disable File System Access API via enterprise policy where not needed. Monitor for navigator.storage.getDirectory() and showOpenFilePicker() calls in telemetry.
  • Network Segmentation: Block outbound connections from browser processes to unknown CDN ranges. Enforce TLS inspection with JA3 fingerprinting to detect Bun's distinct client hello.
  • Behavioral EDR Rules: Alert on bun.exe (or node.exe, deno.exe) child processes of chrome.exe, msedge.exe, firefox.exe with command lines containing run, build, or spawn.
  • Ad Verification: Deploy client-side ad integrity monitoring to detect malicious scripts injected via programmatic channels.

Conclusion

The SourTrade campaign is a wake-up call: attackers no longer need to deliver malware. They can deliver instructions and raw materials and let the victim's environment do the rest. By weaponizing a legitimate, modern runtime like Bun, they turn the browser into a just-in-time malware factory—bypassing network inspection, evading static analysis, and leaving defenders chasing ghosts. As development toolchains grow more powerful and ubiquitous, the boundary between "building software" and "building weapons" vanishes. Security programs must evolve from scanning what arrives to understanding what executes and why. Grivyonx Cloud's AI automation platform specializes in this behavioral depth—correlating browser activity, process lineage, and filesystem mutations to stop compiler-grade threats before they link the final executable.

  • #malvertising
  • #cybersecurity
  • #malware
  • #Bun runtime
  • #SourTrade
  • #threat intelligence
  • #browser exploitation
Gourav Rajput

Gourav Rajput

Founder of Grivyonx Technologies

AI AutomationDevSecOpsCloud Security

Related Intelligence

Cyber Security

100+ Sites Hijacked in Fake Cloudflare LunexStealer Campaign

Ukraine's CERT-UA has exposed a massive campaign where over 100 compromised websites serve LunexStealer malware through deceptive Cloudflare verification pages. The operation, tracked as UAC-0277, leverages social engineering to trick visitors into executing malicious scripts that harvest credentials, crypto wallets, and browser data.

Cyber Security

ClickFix Exploits Trusted Sites: 17K URLs Expose New Malware Tactics

Recent research from CTM360 uncovered more than 17,000 distinct URLs that illustrate how the ClickFix technique converts seemingly legitimate web pages into conduits for malware delivery. The findings show that attackers no longer need to rely on traditional exploit kits or malicious attachments; instead, they manipulate trusted domains to serve harmful payloads. This shift marks a significant change in the threat landscape. By embedding malicious instructions within normal-looking links, threat actors can bypass many perimeter defenses that focus on blocking known bad domains or scanning for suspicious files. The report traces ClickFix’s journey from a niche tactic observed in late 2023 to a mature, subscription‑based service backed by on‑chain infrastructure and even state‑sponsored operators.

Cyber Security

Indexed-btree: A Sneaky npm Package That Hides Its Loader

The npm ecosystem has encountered a new stealthy threat in the form of a counterfeit package called indexed-btree. Disguised to look like a genuine B‑tree utility, this package conceals its malicious loader inside the application’s runtime code, evading conventional lifecycle hooks. The discovery highlights a growing trend of attackers adapting their methods to outmaneuver existing security controls. Researchers note that the fake package mirrors the behavior of a legitimate library, making it difficult for developers to spot the compromise through visual inspection alone. By embedding its payload after the code has started executing, the attackers bypass typical script‑based detection mechanisms that rely on pre‑install or post‑install hooks.

Browse the full Intelligence Hub →