Malvertising Builds Malware Inside Browsers Using Bun

A new malvertising operation called SourTrade has been discovered that tricks web browsers into building a Windows executable from pieces of JavaScript served by legitimate services. The technique uses the open‑source JavaScript engine Bun as its base instead of delivering a complete binary file directly from a fixed URL, making it harder for traditional antivirus scanners to detect the payload early on the client side¹. Confiant reported the activity in an article published July 23, 2026 and said the campaign has operated since late 2024, targeting retail traders who are often less security aware¹.

The attackers impersonated well‑known financial platforms such as TradingView, Solana, and Luno, sending links that appear to come from those trusted domains¹. When a user clicks the link, the browser loads a series of small scripts that assemble themselves into a full‑featured Windows installer at run time. Because the code is generated inside the browser sandbox rather than being injected directly, many modern defenses—such as content‑security policies or endpoint protection rules that flag known malware binaries—are bypassed until the final assembly step occurs.

This approach echoes earlier campaigns that used WebAssembly (WASM) or other runtime environments to obfuscate malicious intent. In 2019 Stack Overflow suffered a similar attack where compromised npm packages delivered harmful JavaScript that was then executed within users’ browsers¹. By leveraging trust assumptions around JavaScript runtimes, SourTrade can evade detection by both network perimeter tools and host‑based signature engines. The use of Bun also means AV scanners typically focus on script execution but not on the subsequent compilation phase that turns the script into native machine code¹.

Experts say social engineering remains key: the fake TradingView and other trading sites lure users with promises of investment opportunities. Retail traders may be more inclined to click suspicious URLs because they expect legitimate market data feeds. Even though the technical trickery is sophisticated, the campaign still relies on human factors such as curiosity and lack of awareness about how browsers handle third‑party scripts¹.

Mitigation steps for organizations include blocking outbound traffic to known malicious domains identified in threat intelligence feeds, enforcing strict CSP headers that prevent inline scripting from untrusted sources, and using endpoint solutions capable of detecting dynamic code generation inside browsers. Users should keep their browsers updated, avoid clicking links from unknown or unexpected emails, and verify site authenticity via HTTPS certificates and domain checks before interacting with financial platforms¹.

In summary, SourTrade demonstrates how attackers are moving beyond simple file downloads toward building malware directly inside the client environment, making it harder to catch until after the user has already loaded the malicious payload. Vigilance at both network level and among end users remains important to reduce exposure to this evolving threat.