Full Report
A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and
Analysis Summary
# Tool/Technique: SourTrade (Browser-Assembled Malware Delivery)
## Overview
**SourTrade** is a sophisticated malvertising operation that employs a novel delivery mechanism where the final malicious Windows executable is assembled locally within the victim's browser. Instead of downloading a complete binary from a static URL, the campaign uses web technologies (ServiceWorkers and SharedWorkers) to stitch together pieces of a legitimate "Bun" runtime with malicious bytecode and randomized padding. This technique is designed to evade network-based security controls and automated sandbox analysis, as no complete malware file ever traverses the network.
## Technical Details
- **Type:** Technique (Malvertising & Client-side Malware Assembly) / Malware Loader
- **Platform:** Windows (Targeting retail traders and crypto investors)
- **Capabilities:** Fingerprinting, Evasion of Network Scanners, Polymorphism (per-victim hashing), and Credential/Wallet Theft.
- **First Seen:** Late 2024 (Evolved significantly through July 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link (Malvertising)]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027.009 - Obfuscation/Decoding: Embedded Payloads]
- [T1564 - Hide Artifacts (Local browser assembly)]
- [T1608.005 - Stage Capabilities: Link Delivery]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery (Browser Fingerprinting)]
## Functionality
### Core Capabilities
- **On-the-Fly Assembly:** Uses a legitimate Bun runtime (downloaded from a clean domain) as a base. It combines this with Portable Executable (PE) headers and malicious JavaScriptCore bytecode (app.js) delivered via Base64 blobs in a JSON configuration.
- **ServiceWorker Orchestration:** Registers a `ServiceWorker` (`sw.js`) and a `SharedWorker` to manage the byte-copy process. The workers use a "recipe" provided by the C2 to combine file segments.
- **Polymorphic Payloads:** Generates a unique pseudorandom byte stream (AES-CTR) for each victim. By rotating the seed and size, the resulting executable's hash is unique for every download.
- **Streaming Delivery:** Uses logic derived from the `StreamSaver.js` library to trigger the final file download via a hidden iframe, making the local landing page appear as the source of the file.
### Advanced Features
- **Sophisticated Fingerprinting:** The landing page evaluates visitors to filter out researchers and bots. If a target is deemed a bot, an empty page is shown; otherwise, a high-quality clone of a crypto/trading site is displayed.
- **Legitimate Tool Abuse:** Leverages the **Bun runtime**, which natively supports compiling applications into standalone Windows executables, providing a "living-off-the-land" style of binary creation.
- **Source Masking:** By assembling the file in the browser, the Mark of the Web (MotW) points to the impersonated landing page rather than the domain hosting the malware components.
## Indicators of Compromise
- **File Names:**
- `sw.js` (Page-scoped ServiceWorker)
- **Network Indicators:**
- purelogicbox[.]org (Source for clean Bun runtime)
- Various impersonated domains (TradingView, Solana, Luno clones)
- **Behavioral Indicators:**
- Unexpected registration of a ServiceWorker on non-interactive pages.
- Large Base64 blobs fetched via a `/config` endpoint.
- Browser processes generating a high volume of pseudorandom data via AES-CTR before a file download.
## Associated Threat Actors
- Unknown (Specifically targeting retail traders and crypto investors across 12 countries).
- Linked by some researchers (Bitdefender/Check Point) to the **JSCEAL** stealer cluster.
## Detection Methods
- **Signature-based:** Detection of the `Variant.DenoSnoop.Marte.1` loader or indicators of the Bun runtime being used in unexpected contexts.
- **Behavioral:** Monitoring for the specific "recipe-based" construction of PE files within browser workers.
- **Network:** Inspecting traffic for the retrieval of the Bun runtime from non-official domains and anomalous `/config` JSON responses containing PE headers.
## Mitigation Strategies
- **User Education:** Advise users to download financial and crypto software only from official, verified domains rather than through search engine ads.
- **Browser Hardening:** Implement policies to restrict ServiceWorker registrations from unknown or untrusted domains where possible.
- **Endpoint Security:** Utilize EDR/AV solutions that scan files at the moment of creation (on-write) to catch the browser-assembled binary despite its polymorphic nature.
## Related Tools/Techniques
- **StreamSaver.js:** The open-source library originally used for the streaming download architecture.
- **Bun Runtime:** The legitimate JavaScript runtime abused to host the malicious bytecode.
- **JSCEAL:** The stealer malware frequently associated with previous iterations of this campaign.