Malvertising Sends Malware in Pieces, Then Makes Its Browser Executable
An incorrect function called SourTrade make the victim’s Windows end-to-end browsers run on their own, using the official Bun runtime as their base instead of using a single complete malicious file from a fixed URL.
Confiant, which detailed the campaign on July 23, 2026, said it has been active since late 2024 and has created TradingView, Solana, and Luno to guide cryptocurrency traders and investors in 12 countries in 25 languages.
Its landing pages fingerprint visitors, showing suspicious researchers and bots a blank page while selected targets receive a convincing copy of the service created by the impersonator. The protection against that is common: install the trading software and wallet from the merchant’s own site, not from the ad.
Scripted threads do not rely on browser vulnerabilities or removing Mark of the Web (MotW). Confiant’s analysis records the delivery, not the use of the file within the browser, and does not guarantee that the final download starts automatically or requires a click.
The landing page starts preparing the delivery method without waiting for the download click. Registers a ServiceWorker with a page on /sw.jsthen create a SharedWorker from the JavaScript already embedded in the page, so that the source of the worker doesn’t appear as a separate download.
SharedWorker requests /configwhich returns a template, the second runtime URL, and some random values for the session. The browser finds and decompresses the pure Bun runtime in that second domain, purelogicbox[.]org for a published sample answer.
Base64 blobs in the configuration provide a Portable Executable (PE) header, a class table, and .bun component containing malicious JavaScriptCore bytecode of app.js. Bun runs on Apple’s JavaScriptCore engine and officially supports the compilation of applications and bytecode into standalone Windows executables.
The worker then generates a large pseudorandom byte stream using AES in counting mode (AES-CTR). It then follows the provided template as a byte copy recipe, which includes a range of selections from the Bun runtime, generated streams, and attacker-controlled executables.
Each victim can get a different compiled file: rotate the seed and size for each one /config the response changes the hash while preserving the valid payment code. “No complete malware has ever existed on a network,” wrote Michael Steele of Confiant’s threat intelligence team. No complete binary does, although PE and bytecode structures come as Base64 in /config.
Once compiled, the page passes the executable to the ServiceWorker as a readable stream. The hidden iframe navigates to the same origin URL, and the worker returns the generated bytes with Content-Disposition attachment header. The resulting MotW record points to the landing page as the download source, not the separate domain that provided the Bun runtime. MotW itself still exists.
The method came from Confiant activity tracked until April 30, 2026, when Pages uploaded StreamSaver.js, an open-source streaming library, to its author’s GitHub page. That left a recorded download path that points to the GitHub library URL. Current pages retain their streaming structure, including streamsaver: message names, but you no longer download it from GitHub.
Bitdefender documented a cluster of TradingView related malpractices in September 2025, identifying its last upload as a stolen Check Point track as JSCEAL and WithSecure as WeevilProxy.
Confiant identifies a shared campaign with usable features but does not indicate that the three published samples carry that payload. The report also says that Bitdefender found a modified Bun exploit in this cluster.
Hacker News found no mention of Bun in Confiant’s September 2025 post, naming a different uploader discovery.DenoSnoop.Marte.1. Credential theft, key entry, traffic blocking, wallet theft, and remote access capabilities were documented in the previous campaign and therefore cannot be provided in the current files.
Hacker News has reached out to Confiant for clarification on its reference to Bitdefender’s previous findings and will update this story with any response.
No software patch can work. The jump is smaller than it first appears. Confiant’s practical-implications section puts it more modestly: the unique architecture of each session limits the amount of simple hash-based discovery. Attacker-controlled PE objects and bytecode still traverse the network.
Defenders must check the entire chain, from the ad transfer and the blocked landing page through the /config application, secondary domain runtime downloads, and ServiceWorker downloads, instead of treating any single network or file artifact as deterministic.
Confiant published three SHA-256 hashes and a list of malicious domains, 96 by The Hacker News count. The company did not name the actor and stopped the analysis while the file was on the disk.
