- SourTrade malvertising campaign targets cryptocurrency investors by assembling malware inside the victim’s browser using a legitimate Bun runtime.
- It operates since late 2024, impersonating TradingView, Solana, and Luno across 12 countries in 25 languages.
- The attack evades hash-based detection by generating a unique executable per session from a template and random seeds.
- Defenders should examine the full chain from ad referral to ServiceWorker download rather than rely on single artifacts.
A malvertising campaign dubbed SourTrade has been targeting cryptocurrency investors across 12 countries since late 2024, according to a report from Confiant on July 23, 2026. The campaign impersonates TradingView, Solana, and Luno to lure retail traders and crypto investors.
Its landing pages fingerprint visitors, showing researchers an empty page while selected targets receive a convincing copy of the impersonated service. The attack does not rely on a browser vulnerability or remove the Mark of the Web.
The landing page registers a ServiceWorker and builds a SharedWorker from JavaScript already embedded in the page. The SharedWorker requests a /config endpoint that returns a template, a secondary runtime URL, and session-specific random values.
The browser retrieves a clean Bun runtime from a separate domain, then uses Base64 blobs from the configuration to supply the PE header, section table, and malicious JavaScriptCore bytecode. Bun legitimately supports compiling applications and bytecode into standalone Windows executables.
The worker generates a pseudorandom byte stream using AES-CTR and follows the template as a byte-copy recipe, combining ranges from the Bun runtime, the generated stream, and attacker-controlled material. “No finished malware ever exists on the network,” wrote Michael Steele of Confiant‘s threat intelligence team.
Each victim receives a different assembled file, rotating the seed and size in each /config response to change the hash while retaining the payload. The method evolved from earlier activity that used StreamSaver.js; the current pages keep the streaming architecture but no longer fetch it from GitHub.
Bitdefender documented the related TradingView malvertising cluster in September 2025, identifying its final payload as the stealer tracked as JSCEAL by Check Point and WeevilProxy by WithSecure. Confiant identifies shared campaign characteristics but does not demonstrate that the three published samples carry that payload.
There is no software patch to apply. Defenders should examine the entire chain from the ad referral and cloaked landing page through the /config request, the secondary-domain runtime fetch, and the ServiceWorker download.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
