Ethical Hacking News
Malvertising is evolving to new heights with the "SourTrade" operation, using an unconventional strategy that involves serving pieces of malicious code to victims' browsers and having them assemble the final executable. Confiant's analysis has uncovered a unique method of malware distribution that is challenging traditional security measures. As experts scramble to keep up with this new threat, it becomes clear that no software patch will be enough to stop these evolving malvertisments.
The "SourTrade" malvertising campaign uses a legitimate Bun runtime to serve malicious code, making it challenging for security software to detect. The operation impersonates popular trading and cryptocurrency websites to gain victims' trust. The malware sends requests to a secondary domain, which returns a template, runtime URL, and session-specific values, assembled into an executable file. Each victim receives a different assembled file, rotating the seed and size in each config response changes the hash while retaining the executable payload code. No software patch is available, as the evasion mechanism relies on unique per-session builds, limiting the value of simple hash-based detections.
Malvertising has become a significant threat to online security, and the latest campaign dubbed "SourTrade" is taking the industry by storm. Confiant, a cybersecurity firm that specializes in tracking malvertising operations, has uncovered a unique method of malware distribution that is leaving experts scratching their heads.
According to Confiant's analysis, the SourTrade operation uses a legitimate Bun runtime as its base and serves pieces of malicious code to victims' browsers, which then assemble the final executable. This approach is unlike traditional malvertising operations, where a complete malicious file is served from a fixed URL. The use of a legitimate runtime and the assembly process make it challenging for security software to detect and block the malware.
The operation targets retail traders and cryptocurrency investors across 12 countries in 25 languages, impersonating TradingView, Solana, and Luno to gain their trust. Once a victim's browser is compromised, the malware sends a request to a secondary domain, purelogicbox[.]org, which returns a template, a runtime URL, and session-specific random values. The browser then retrieves and decompresses a clean Bun runtime from that second domain.
The runtime contains Base64 blobs that supply the Portable Executable (PE) header, section table, and a .bun section containing malicious JavaScriptCore bytecode for app.js. A worker generates a large pseudorandom byte stream using AES in counter mode, combines selected ranges from the runtime, the generated stream, and attacker-controlled executable material, and follows the supplied template as a byte-copy recipe.
Each victim can receive a different assembled file, rotating the seed and size in each config response changes the hash while retaining the executable payload code. The method evolved from activity Confiant tracked through April 30, 2026, when the pages loaded StreamSaver.js from its author's GitHub Pages address.
The current pages keep this streaming architecture but no longer fetch it from GitHub. Bitdefender documented a modified Bun executable in this cluster, while The Hacker News reached out to Confiant for clarification on its reference to Bitdefender's earlier findings.
Experts warn that there is no software patch to apply, as the evasion mechanism relies on the unique per-session builds, limiting the value of simple hash-based detections. Defenders should examine the whole chain, from the ad referral and cloaked landing page through the config request, the secondary-domain runtime fetch, and the ServiceWorker download.
Confiant published three SHA-256 hashes and a list of malicious domains but named no actor and stopped its analysis at the moment the file lands on disk. This highlights the ongoing cat-and-mouse game between security software vendors and malvertising operations.
Related Information:
https://www.ethicalhackingnews.com/articles/Malvertisings-Unconventional-Strategy-A-New-Front-in-Malware-Distribution-ehn.shtml
https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html
https://utopiats.com/blog/malvertising-sends-malware-in-pieces-then-makes-the-browser-build-the-executable
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
https://www.confiant.com/solutions/security
https://www.bitdefender.com/business/support/en/77209-36453-scanning-for-malware.html
https://www.bitdefender.com/en-us/
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://cybergeodigest.com/resources/apt-groups-tracker.html
Published: Sat Jul 25 15:44:00 2026 by llama3.2 3B Q4_K_M
