Executive Summary
In July 2026, a sophisticated malvertising campaign named SourTrade was identified, targeting retail traders and cryptocurrency investors across 12 countries. Active since late 2024, the attackers impersonated reputable platforms like TradingView, Solana, and Luno to lure victims. Instead of delivering a static malicious file, the campaign utilized the victims' browsers to assemble unique Windows executables in memory, leveraging a legitimate Bun runtime. This method effectively evaded traditional security detections by ensuring no complete malware existed on the network. (bleepingcomputer.com)
The SourTrade operation underscores a significant evolution in malvertising tactics, highlighting the increasing sophistication of threat actors in circumventing security measures. This incident serves as a critical reminder for organizations to enhance their cybersecurity defenses, particularly against advanced browser-based threats. (bleepingcomputer.com)
Why This Matters Now
The SourTrade campaign exemplifies the growing trend of attackers using browsers as assembly lines for malware, making detection and prevention more challenging. As malvertising techniques become more sophisticated, it's imperative for organizations to stay vigilant and adopt advanced security measures to protect against such evolving threats. (bleepingcomputer.com)
Attack Path Analysis
The SourTrade malvertising campaign began by delivering malicious advertisements that led users to counterfeit websites mimicking legitimate trading platforms. Upon visiting these sites, users' browsers were manipulated to assemble a unique Windows executable from fragmented components, including a legitimate Bun runtime and malicious JavaScriptCore bytecode. This executable was then downloaded and executed by the user, granting the attackers initial access to the system. Subsequently, the malware escalated privileges to gain higher-level access, moved laterally within the network to infect additional systems, established command and control channels to communicate with attacker-controlled servers, exfiltrated sensitive data, and ultimately caused significant operational disruption.
Kill Chain Progression
Initial Compromise
Description
Users were lured through malicious advertisements to counterfeit websites impersonating legitimate trading platforms, where their browsers assembled and downloaded a malicious executable.
Related CVEs
CVE-2024-21548
CVSS 7.5Prototype Pollution vulnerability in Bun JavaScript runtime allows attackers to manipulate object prototypes, potentially leading to arbitrary code execution.
Affected Products:
Oven Bun – 0.0.13 to 1.1.29
Exploit Status:
no public exploitCVE-2025-8022
CVSS 8.8OS Command Injection vulnerability in Bun JavaScript runtime's $ shell API allows attackers to execute arbitrary commands via crafted input.
Affected Products:
Oven Bun – 0.0.13 and later
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Malvertising
Masquerading
System Binary Proxy Execution
User Execution: Malicious Link
Command and Scripting Interpreter: PowerShell
Ingress Tool Transfer
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – User and Device Authentication
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
SourTrade malvertising directly targets retail traders through TradingView impersonation, exploiting browser vulnerabilities to deliver malware via legitimate Bun runtime assembly techniques.
Capital Markets/Hedge Fund/Private Equity
Trading platform impersonation poses critical risks to investment operations, with malware delivery bypassing traditional security controls through browser-based executable construction methods.
Marketing/Advertising/Sales
Malvertising campaigns compromise ad networks and legitimate platforms, requiring enhanced egress filtering and anomaly detection to prevent malicious payload delivery mechanisms.
Computer Software/Engineering
Browser-based malware assembly techniques exploit legitimate development tools like Bun runtime, necessitating enhanced inline IPS and threat detection capabilities for software environments.
Sources
- Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executablehttps://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.htmlVerified
- SourTrade Malvertising Builds Unique Malware Inside Victims’ Browsers to Evade Detectionhttps://cybersecuritynews.com/sourtrade-malvertising-malware/Verified
- Malicious sites use JavaScript to build malware in browser memoryhttps://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/Verified
- SourTrade Malware Is Built Inside Your Browserhttps://blog.gridinsoft.com/sourtrade-browser-assembled-malware/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to the SourTrade malvertising campaign as it would likely constrain the attacker's ability to move laterally and exfiltrate data, thereby reducing the overall blast radius of the incident.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to establish initial access may be limited, reducing the likelihood of successful exploitation.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may be constrained, reducing the scope of potential damage.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the spread of the infection.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels may be limited, reducing the effectiveness of remote control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of data loss.
The overall impact of the attack would likely be reduced, limiting operational disruption and associated damages.
Impact at a Glance
Affected Business Functions
- Trading Platforms
- Cryptocurrency Exchanges
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of user credentials and financial data from trading and cryptocurrency platforms.
Recommended Actions
Key Takeaways & Next Steps
- • Implement robust egress security and policy enforcement to control outbound traffic and prevent unauthorized data exfiltration.
- • Deploy inline intrusion prevention systems (IPS) to detect and block known exploit patterns and malicious payloads.
- • Utilize zero trust segmentation to enforce least privilege access and limit lateral movement within the network.
- • Enhance threat detection and anomaly response capabilities to identify and respond to suspicious activities promptly.
- • Ensure comprehensive multicloud visibility and control to monitor and manage security across all cloud environments.
