Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

The SourTrade malvertising campaign exploits users' trust in familiar trading and crypto platform branding to lure victims into triggering a multi-stage malware assembly process entirely within their own browser. By splitting the malicious payload into innocuous-looking components and using a legitimate runtime (Bun) to stitch them together, attackers bypass traditional signature-based detection that looks for complete malicious files on the network. This technique reflects an escalating arms race where adversaries exploit trusted tooling and living-off-the-land strategies to avoid endpoint and network defenses. The campaign's evolution since late 2024 signals that threat actors are actively refining this approach, meaning organizations relying solely on perimeter or hash-based detection will remain exposed.