[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnyZ_Qd_KyuvgH61LK3TkO1yUbqYiSpKz59Z3xvcNjJI":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"7052a595-9bbd-402e-891c-5bdc0a70ea53","Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable","malvertising-sends-malware-in-pieces-then-makes-the-browser-build-the-executable-17ff67","A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and","A malvertising campaign named SourTrade impersonates popular trading and crypto platforms to deliver malware. Instead of a direct download, it leverages a legitimate Bun runtime and victim browsers to assemble the final Windows executable from various components, making detection more challenging. This method avoids storing complete malware on the network and has been evolving since late 2024.","SourTrade malvertising operation uses victim browsers to assemble malware executables.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fmalvertising-sends-malware-in-pieces.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj7ke_659Oiks4UyEwQJsTV2c-8DaJnDPNG3RKPsk3s_CLYO5y_vD-SdtGebpYlDbDkXFt2iW4qgZHhM4Tfp2FV5RJSc3f85Ap4KQP-RI1BM8MCPbYhgSD5uusxi09thhL4avaYfCPkj5H_9t0-unj84RktTVGUwV9FF0bdZjuRQley0rZrFDLLE4JXIJk\u002Fs1600\u002Fbrowser-malware.jpg","2026-07-25T18:48:44+00:00","2026-07-25T22:00:09.183397+00:00",8,[17,20,23,25],{"name":18,"type":19},"SourTrade","campaign",{"name":21,"type":22},"Bun","product",{"name":24,"type":22},"JavaScriptCore",{"name":26,"type":22},"StreamSaver.js","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"domain","purelogicbox[.]org","Secondary runtime URL used to retrieve Bun runtime",[21,24,26],{"controls":52,"vendors":135},[53,82,109],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":83,"name":84,"problem":85,"products":86},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[87,93,101],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":88,"product_name":89,"url":91,"description":92},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"slug":110,"name":111,"problem":112,"products":113},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":123,"product_name":124,"url":125,"description":126},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":150},"malvertising-campaign-assembles-malware-in-the-browser-to-evade-detection","Malvertising Campaign Assembles Malware in the Browser to Evade Detection","The SourTrade malvertising campaign exploits users' trust in familiar trading and crypto platform branding to lure victims into triggering a multi-stage malware assembly process entirely within their own browser. By splitting the malicious payload into innocuous-looking components and using a legitimate runtime (Bun) to stitch them together, attackers bypass traditional signature-based detection that looks for complete malicious files on the network. This technique reflects an escalating arms race where adversaries exploit trusted tooling and living-off-the-land strategies to avoid endpoint and network defenses. The campaign's evolution since late 2024 signals that threat actors are actively refining this approach, meaning organizations relying solely on perimeter or hash-based detection will remain exposed.",[141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 CM-7: Least Functionality (application allowlisting)","MITRE ATT&CK T1027: Obfuscated Files or Information","MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1218: System Binary Proxy Execution (Living-off-the-land)",{}]