Malvertising has matured beyond simply embedding links to malware repositories. A campaign dubbed SourTrade, active since late 2024, demonstrates a markedly different approach: rather than serving a complete executable, it fragments the payload and lets the victim's browser perform the assembly itself. This shift in delivery mechanism reveals an escalating arms race between adversaries and the detection systems protecting ad networks.
Fragmentation as Evasion
Traditional malware detection relies on matching file hashes, examining file headers, and analysing URLs hosting known payloads. Once a malicious binary appears on a scanning service or in endpoint logs, it enters threat intelligence systems within hours. SourTrade sidesteps this by never serving a complete executable from a fixed URL. Instead, it sends fragments—often disguised as legitimate resources—which the browser concatenates and executes on the client machine.
This approach reduces the surface area available to security scanning. A fragment by itself may appear benign or unclassifiable. Only when reassembled in memory does the malicious intent emerge. Endpoint Detection and Response (EDR) systems that rely on file-level detection must catch the assembly moment, which requires behavioural analysis rather than signature matching.
Leveraging Legitimate Tooling
SourTrade's choice to use the Bun JavaScript runtime as its base is instructive. Bun is a legitimate, open-source runtime designed for server-side JavaScript execution and bundling. By targeting Bun specifically, the campaign exploits trust in established tooling. A system administrator or security analyst seeing Bun in process logs may not flag it immediately—it's a known, widely-used tool.
This technique mirrors a broader pattern in adversarial tradecraft: rather than building custom executors, attackers co-opt legitimate infrastructure. It reduces the burden of malware development and increases the likelihood that defensive rules won't immediately quarantine execution. The malware then runs within Bun's process space, potentially evading process isolation and containment checks that expect standalone executables.
Targeting and Credential Theft
SourTrade impersonates trading and blockchain platforms—TradingView, Solana, and Luno—to target retail traders. These victims typically lack the security posture of enterprise environments. A trader seeing an ad for a trading platform they already use is more likely to click. Once the payload assembles and executes, the malware establishes persistence and harvests credentials, session tokens, and wallet information.
The campaign's focus on financial platforms is revealing. Attackers understand that victims with access to cryptocurrency wallets or brokerage accounts represent high-value targets. A single compromised wallet can yield thousands of pounds in seconds; a brokerage session grants access to leverage trading and fund transfers.
Implications for Ad Networks and Hosters
Ad networks and hosting providers sit at the front line of this conflict. Malvertisers must register accounts, purchase ad placements, and often host redirect chains and landing pages on rented infrastructure. Detection requires monitoring for suspicious ad creative, unusual redirect patterns, and rapid domain registration cycles.
Confiant's analysis suggests SourTrade has operated for nearly two years without widespread takedown, indicating either sophisticated evasion or limited cross-platform detection sharing. Infrastructure providers hosting ad networks must invest in traffic pattern analysis and behavioural sandboxing of ad content—not merely static scanning.
For those running private or offshore infrastructure, the lesson is clear: adversaries will adapt their delivery methods faster than signature-based detection can keep pace. Behavioral monitoring, memory forensics, and process-level isolation become essential. Organisations relying on traditional perimeter defences will remain behind the curve.
Closing Thought
SourTrade represents an evolution in malware delivery that treats the victim's browser and runtime environment as the final assembly plant. By fragmenting payloads and using legitimate tools, attackers reduce detection opportunities and increase operational longevity. For infrastructure defenders, this reinforces the need for layered detection—not just static analysis, but runtime behaviour monitoring, anomalous process execution detection, and rapid incident response. The cost of detection evasion has become so low that adversaries can afford to iterate; the cost of remediation remains high.
