As reported by The Hacker News, a sophisticated malvertising campaign dubbed SourTrade has been actively targeting retail traders and cryptocurrency users since late 2024, employing a novel payload delivery technique that weaponizes the victim's own browser to construct the final malicious Windows executable.
Why This Technique Is a Genuine Inflection Point
The security industry has long tracked malvertising as a persistent threat vector, but SourTrade represents a meaningful evolution in evasion sophistication. By fragmenting the malicious payload and delivering it in discrete, seemingly innocuous chunks — then leveraging the victim's browser to reassemble those fragments into a functional executable — the operators effectively sidestep one of the most fundamental assumptions in network-based threat detection: that a malicious file must transit the network as a recognizable whole.
Traditional signatures, hash-based detection, and even many behavioral sandboxes operate on complete file artifacts. When no single network request or file write event looks like malware in isolation, the attack surface for defenders shrinks dramatically. This is not merely a clever trick — it signals that malvertising operators are investing in detection engineering countermeasures at a level previously associated primarily with nation-state tooling.
The Bun Runtime Angle: Abusing Legitimacy
The use of the legitimate Bun JavaScript runtime as the execution foundation is equally notable. Living-off-the-land (LotL) and bring-your-own-legitimate-binary (BYOLB) techniques have become staple tradecraft for evading endpoint controls, precisely because security tools struggle to flag trusted, signed binaries as malicious. By anchoring the payload in a recognizable, non-flagged runtime, SourTrade operators create an execution environment that is genuinely difficult to block without causing collateral damage to legitimate Bun users.
This mirrors patterns observed in campaigns abusing Node.js, Python interpreters, and .NET runtimes — but the choice of Bun is deliberate. It is modern, increasingly popular in developer and crypto-adjacent communities, and its allowlist status in many organizations remains unexamined.
Target Profile: Why Retail Traders and Crypto Users?
The impersonation of platforms like TradingView, Solana, and Luno is not accidental. These communities share several characteristics that make them high-value, high-vulnerability targets:
Broader Implications for the Threat Landscape
SourTrade should be read as a proof-of-concept that will be replicated. Once a technique demonstrates effectiveness against commercial detection stacks, it proliferates across the criminal ecosystem rapidly. Security teams at ad networks, financial platforms, and crypto exchanges need to treat browser-side payload assembly as an emerging threat class — not an edge case.
The most dangerous evolution in malvertising isn't louder attacks — it's quieter ones. SourTrade's architects understood that the detection gap isn't in the payload; it's in the assembly process. Defenders need to close that gap before this technique becomes commoditized.
Ad network operators bear particular responsibility here. The malvertising supply chain remains under-scrutinized from a security standpoint, with trust delegated across multiple intermediaries. SourTrade exploits exactly this governance gap.
Shield53 Recommendations
For Individual Retail Traders and Crypto Users
- Download trading and crypto software exclusively from official, bookmarked vendor URLs — never from ads, search results, or unsolicited links.
- Verify installer hashes against values published on official vendor sites before execution.
- Treat any prompt to install a runtime environment (Bun, Node.js, Python) from a trading platform as an immediate red flag.
- Use a dedicated, isolated device or browser profile for high-value financial activity.
For Security Teams and Defenders
- Hunt for Bun runtime installations in your environment, particularly on endpoints that have no legitimate developer use case. Unexpected Bun presence should trigger investigation.
- Implement application allowlisting that requires explicit approval for new runtime environments — not just known-bad blocking.
- Monitor for fragment-based download patterns: Multiple small, sequentially fetched resources from the same domain that culminate in a file write or process spawn deserve scrutiny.
- Audit browser extension permissions and review any recently installed extensions on endpoints used for financial operations.
- Block ad network domains at the DNS layer on endpoints handling sensitive financial operations where advertising has no legitimate business purpose.
- Engage your EDR vendor to understand their detection coverage for browser-initiated file assembly and runtime abuse scenarios — and request explicit roadmap items if gaps exist.
For Organizations in Fintech and Crypto
- Issue user advisories warning your customer base about impersonation campaigns targeting your brand specifically.
- Implement brand protection monitoring to detect malicious ad campaigns impersonating your platforms in near-real time.
- Consider publishing signed installer hashes and PGP-verified downloads as a standard practice, not an exception.
SourTrade is not merely a malvertising story — it is an early signal that commodity cybercrime is absorbing advanced evasion techniques at an accelerating pace. Organizations and individuals operating in the financial and cryptocurrency space need to treat their download and software installation habits as a primary attack surface, not an afterthought.
