A New Kind of Malvertising Trick

A malvertising campaign tracked as SourTrade is taking an unusual approach to sneaking malware past security tools: instead of delivering a single malicious file, it breaks the payload into fragments and has the victim's own browser stitch them back together into a working Windows executable. According to reporting on the campaign, SourTrade relies on the Bun JavaScript runtime alongside browser worker processes to handle this assembly, and it has already been observed operating across 12 countries.

The term malvertising refers to malicious code delivered through online advertising, often without requiring the user to click anything beyond a normal-looking ad or webpage element. What makes SourTrade notable isn't the delivery method itself, which is common, but the construction technique used once a victim's browser starts processing the ad content.

How Browser-Assembled Malware Slips Past Detection

Most antivirus and endpoint protection tools rely heavily on hash-based detection: they compare a file against known signatures of malware that has already been identified and cataloged. This works well when every victim receives the exact same file, because a single hash can flag every copy of it.

SourTrade appears designed specifically to break that model. By splitting the malicious payload into pieces and using browser workers, background threads that run scripts without blocking the main page, to reconstruct the executable inside each victim's browser session, the campaign produces a unique file for every single infection. Since no two assembled executables share the same hash, traditional signature-based scanning has far less to work with. The use of Bun, a fast JavaScript runtime, reportedly helps the process execute this in-browser construction efficiently enough to avoid raising obvious performance flags that might tip off a user or a security tool.

Once assembled, the resulting file is a standard Windows executable, meaning it can carry out whatever malicious function its operators built into it, from credential theft to establishing persistent remote access on the infected machine.

Why Per-Session Builds Matter for Detection at Scale

The reported reach of SourTrade across 12 countries suggests this isn't a small, isolated test but an active campaign with real infrastructure behind it. Per-session executable generation is a meaningful shift in tactics because it directly targets the weakest link in traditional antivirus defense: the assumption that malware samples are static and reusable across victims.

Security researchers typically counter this kind of evasion with behavioral detection, watching what a file does rather than what it looks like, but that approach requires more sophisticated tooling than simple hash matching. For everyday users and even many small organizations, the security software running on their machines may still lean heavily on signature databases, leaving a gap that campaigns like SourTrade are built to exploit. Once a machine is compromised this way, it can also become part of a larger botnet, a network of infected devices controlled remotely without their owners' knowledge, which expands the attacker's reach far beyond a single victim.

What This Means For You

You don't need to be a security researcher to reduce your risk from campaigns like SourTrade. Malvertising generally depends on ads or embedded scripts loading on pages you visit, often through legitimate ad networks that have been compromised or abused rather than obviously sketchy websites. That means the usual advice to "just avoid shady sites" isn't sufficient protection on its own.

Browser extensions that block ad scripts and third-party trackers reduce the surface area available for this kind of attack, since much of the malicious logic never gets a chance to execute if the ad content itself is blocked before loading. Keeping your browser and operating system updated also matters, since patches often close off the specific mechanisms attackers rely on to run scripts silently in the background. And because per-session, uniquely built malware is harder for hash-based tools to catch, relying on security software that includes behavioral or heuristic analysis, not just signature matching, gives you a meaningfully better chance of catching something unusual before it does damage.

Key Takeaways

  • SourTrade malvertising assembles a unique Windows executable per victim session, making traditional hash-based antivirus detection far less effective.
  • The campaign uses the Bun JavaScript runtime and browser worker processes to perform this in-browser construction.
  • It has been observed across 12 countries, suggesting active, ongoing infrastructure rather than a limited test.
  • Ad-blocking browser extensions, prompt software updates, and security tools with behavioral detection capabilities offer stronger protection than signature-based scanning alone.
  • Infected machines can be folded into larger botnets, so individual infections carry risks that extend beyond the original victim.