Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

A malvertising campaign known as SourTrade is using a unique approach to deliver malware, where the browser is tricked into building the final Windows executable itself. This is achieved by utilizing a legitimate Bun runtime as the base, rather than serving a complete malicious file from a fixed URL. The campaign, which has been operational since late 2024, has been impersonating various brands, including TradingView, Solana, and Luno, in an effort to target retail traders. The operation was detailed by Confiant on July 23, 2026.