Malvertising Campaign Assembles Malware in the Browser to Evade Detection
Written by AI from the linked story. Not reviewed by an editor. How this works
The SourTrade malvertising campaign exploits users' trust in familiar trading and crypto platform branding to lure victims into triggering a multi-stage malware assembly process entirely within their own browser. By splitting the malicious payload into innocuous-looking components and using a legitimate runtime (Bun) to stitch them together, attackers bypass traditional signature-based detection that looks for complete malicious files on the network. This technique reflects an escalating arms race where adversaries exploit trusted tooling and living-off-the-land strategies to avoid endpoint and network defenses. The campaign's evolution since late 2024 signals that threat actors are actively refining this approach, meaning organizations relying solely on perimeter or hash-based detection will remain exposed.
Tactical Insight
Immediate actions
- Deploy ad-blocking and malicious URL filtering solutions (e.g., DNS-layer security) for all endpoints to prevent malvertising redirects.
- Alert on and investigate unexpected use of non-standard runtimes like Bun on endpoints where they are not approved software.
Detection measures
- Enable behavioral endpoint detection (EDR) rules that flag in-browser file assembly, unusual child process spawning from browsers, or execution of newly written executables from temp directories.
- Implement network monitoring that inspects multi-part downloads and correlates fragmented payloads arriving from advertising networks or CDNs.
- Audit and alert on use of legitimate development runtimes (Node, Bun, Deno) in non-developer environments.
Long-term improvements
- Enforce application allowlisting policies to prevent unauthorized runtimes and executables from running on end-user machines.
- Conduct regular security awareness training focused on social engineering via impersonation of financial and crypto platforms.
- Establish a threat intelligence feed subscription to stay current on evolving malvertising campaigns and update detection rules proactively.