A long-running malvertising campaign is delivering Windows malware not as a complete binary, but as scattered components that the victim's own browser assembles into an executable—a technique that sidesteps many conventional file-scanning defenses.
According to research from ad-security firm Confiant, detailed on July 23, 2026 and reported by The Hacker News, the operation dubbed SourTrade has been active since late 2024 and has operated across 12 countries. Instead of hosting a complete malicious payload at a fixed address, the campaign feeds fragments to the browser and leverages the legitimate Bun JavaScript runtime as the foundation for the final build. The result is a functional Windows executable constructed on the endpoint itself, not downloaded as a single suspicious file—a design that limits simple hash-based detection.
The Browser as an On-Device Build System
SourTrade reaches users through malicious advertisements impersonating well-known trading and crypto brands, including TradingView, Solana, and Luno. The lure targets retail traders—a group prone to installing charting tools and wallet software frequently, often under time pressure.
Once a victim engages with the ad, the browser becomes the assembly environment. Payload fragments are delivered in stages, and the Bun runtime, a legitimate developer tool, provides cover and capability for combining the pieces into a functional executable. Because no complete malicious binary travels from a single known-bad URL, signature-based scanners and heuristic checks expecting a whole file are often ineffective.
This highlights a broader evolution: attackers now treat the browser less as a simple delivery channel and more as a build system. Legitimate tooling is weaponized as camouflage, allowing activity to bypass defenses that only block known-bad binaries or domains.
Why It Matters: Gaps in Current Models
For enterprise IT teams and security practitioners, SourTrade exposes flaws in models still centered on inbound file inspection. Browser-initiated script execution, unexpected runtime installations, and anomalous patterns of small file downloads followed by executable creation become critical signals—often more telling than a single hash match.
Developer-oriented runtimes like Bun are dual-use by nature. Effective defense requires assessing the context and justification for their presence on endpoints, not just their signature or reputation. The campaign also reminds the broader tech community that popular tooling can be weaponized without upstream compromise. Generic warnings about "cracked software" miss this threat, where the install path appears to be a normal download from a trusted brand.
Retail traders are a calculated target: they routinely install third-party software, operate under market deadlines, and may grant permissions quickly. Similar assembly-style delivery could easily target other high-value niches, such as developer toolchains or creative suites.
A Layered Defense Response
Confiant's findings point toward layered controls rather than a single solution. Effective countermeasures include tightening policy around browser-driven script and runtime execution, applying application allowlisting to constrain in-browser assembly, and monitoring for unusual sequences of component downloads.
Network and endpoint telemetry that correlates ad-driven navigation with subsequent Bun or similar runtime activity may surface these campaigns earlier than traditional sandboxes. User training should also evolve—moving beyond generic phishing warnings to targeted education for high-risk groups about the dangers of installing software directly from advertisements, even when branding appears authentic.
SourTrade does not rely on a novel zero-day, but rather on a clear-eyed exploitation of how browsers, ads, and developer tools intersect. As long as users install software from promotional links and security stacks assume malware arrives whole, assembly-in-the-browser techniques will remain attractive to threat actors targeting finance-adjacent audiences and beyond.
For IT professionals evaluating browser hardening, endpoint detection rules, and user education, the Confiant research is a concrete case study in why these controls must evolve together.
一場長時間運作的惡意廣告活動，正以非完整二進制檔案的形式傳播 Windows 惡意軟件。它改為發送零散的組件片段，並由受害者的瀏覽器自行將其組合成可執行檔——這種技術繞過了許多傳統的檔案掃描防禦。
根據廣告安全公司 Confiant 於 2026 年 7 月 23 日公佈的詳細研究（並由 The Hacker News 報導），這項名為 SourTrade 的行動自 2024 年底以來一直活躍，並已橫跨 12 個國家/地區運作。該活動並非在固定地址托管完整的惡意酬載，而是向瀏覽器輸送片段，並利用合法的 JavaScript runtime Bun 作為最終組建的基礎。結果是在終端設備上直接建構出一個功能性的 Windows 可執行檔，而不是下載單個可疑檔案——這種設計限制了簡單的雜湊值基礎檢測。
瀏覽器成為設備端組建系統
SourTrade 透過模仿 TradingView、Solana 及 Luno 等知名交易和加密貨幣品牌的惡意廣告接觸用戶。誘餌的目標是散戶交易者——這群人經常安裝圖表工具和錢包軟件，且常在時間壓力下操作。
一旦受害者點擊廣告，瀏覽器便成為組裝環境。酬載片段分階段傳送，而 Bun runtime——一個合法的開發者工具——則提供掩護和能力，將這些片段組合成一個功能性的可執行檔。由於沒有完整的惡意二進制檔從單一已知惡意 URL 傳輸，因此期望掃描整個檔案的簽名式掃描器和啟發式檢查通常無效。
這凸顯了更廣泛的演變：攻擊者現在不再將瀏覽器視為簡單的傳遞渠道，而是視其為一個組建系統。合法工具被武器化作為偽裝，使活動得以繞過僅阻止已知惡意二進制檔或網域的防禦。
為何重要：現有模型的缺口
對於企業 IT 團隊和安全從業人員而言，SourTrade 暴露了仍以入站檔案檢查為中心的模型缺陷。瀏覽器發起的腳本執行、意外的 runtime 安裝，以及異常的小檔案下載後創建可執行檔的模式，成為了關鍵信號——往往比單一雜湊值比對更具說明性。
面向開發者的 runtime（例如 Bun）本質上是雙用途的。有效的防禦需要評估它們出現在終端設備上的背景和理由，而不僅僅是其簽名或信譽。該活動也提醒整個技術界，受歡迎的工具無需上游被入侵即可被武器化。關於「破解軟件」的一般性警告無法涵蓋此類威脅，因為其安裝路徑看似是來自可信品牌的正常下載。
散戶交易者是精心挑選的目標：他們經常安裝第三方軟件、在市場截止日期壓力下操作，並可能快速授予權限。類似的組裝式傳遞方式很容易針對其他高價值領域，例如開發者工具鏈或創意軟件套裝。
分層防禦回應
Confiant 的發現指向需要分層控制，而非單一解決方案。有效的對策包括收緊圍繞瀏覽器驅動的腳本和 runtime 執行的策略、應用應用程式白名單以限制瀏覽器內組裝，以及監控異常的組件下載順序。
網絡和終端遙測若能關聯廣告導航與隨後的 Bun 或類似 runtime 活動，可能比傳統沙箱更早發現這些活動。用戶培訓也應演進——超越一般的釣魚警告，針對高風險群體進行針對性教育，說明即使品牌看起來真實，從廣告直接安裝軟件的危險性。
SourTrade 並未依賴新穎的零日漏洞，而是清晰地利用了瀏覽器、廣告和開發者工具交匯的方式。只要用戶從推廣連結安裝軟件，且安全堆棧假設惡意軟件會完整到達，瀏覽器內組裝技術對於瞄準金融相關受眾及更廣泛領域的威脅行為者來說，仍將具有吸引力。
對於評估瀏覽器強化、終端檢測規則和用戶教育的 IT 專業人員而言，Confiant 的研究是一個具體的案例研究，說明了為何這些控制措施必須同步演進。